Read the docs
TI-2021-04743 Aliases CVE-2021-21663GHSA-6mpp-cm3v-23vv

Missing authorization in Jenkins XebiaLabs XL Deploy Plugin

Priority LOW 22CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

Why it matters now

EPSS 0.01001 63rd percentileScored 2026-11-07
Fix Fixed com.xebialabs.deployit.ci:deployit-plugin (Maven): 10.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins XebiaLabs XL Deploy Plugin7.5.6 and later; up to 7.5.8—No fix listedCNA
—com.xebialabs.deployit.ci:deployit-plugin (Maven)before 10.0.210.0.2Patch availableGHSA-6mpp-cm3v-23vv
  • Jenkins XebiaLabs XL Deploy Plugin VendorJenkins Affected 7.5.6 and later; up to 7.5.8 Fixed in — No fix listed CNA
  • com.xebialabs.deployit.ci:deployit-plugin (Maven) Vendor— Affected before 10.0.2 Fixed in 10.0.2 Patch available GHSA-6mpp-cm3v-23vv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:xebialabs_xl_deploy:*:*:*:*:*:jenkins:*:*up to 7.5.8VulnerableJenkins
  • cpe:2.3:a:jenkins:xebialabs_xl_deploy:*:*:*:*:*:jenkins:*:* Versions up to 7.5.8 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-6mpp-cm3v-23vv com.xebialabs.deployit.ci:deployit-plugin (Maven) Fixed in 10.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Jenkins XebiaLabs XL Deploy Plugin unspecified

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-04744 Incorrect authorization in Jenkins XebiaLabs XL Deploy PluginPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21663
  2. 2026-10-03 Alias added: GHSA-6mpp-cm3v-23vv

References

Advisory 3

Other 1

  • TI-2021-04745 Cross-site request forgery in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1HIGH 8.8
  • TI-2021-04744 Incorrect authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 6.5
  • TI-2019-07614 Missing authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 6.5
  • TI-2019-07613 Cross-site request forgery in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.0MEDIUM 6.5
  • TI-2021-04742 Missing authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences