Read the docs
TI-2021-04744 Aliases CVE-2021-21664GHSA-jm4g-8rvq-v87j

Incorrect authorization in Jenkins XebiaLabs XL Deploy Plugin

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

Why it matters now

EPSS 0.00991 62nd percentileScored 2026-11-07
Fix Fixed com.xebialabs.deployit.ci:deployit-plugin (Maven): 10.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins XebiaLabs XL Deploy Plugin7.5.9 and later; up to 10.0.1—No fix listedCNA
—com.xebialabs.deployit.ci:deployit-plugin (Maven)before 10.0.210.0.2Patch availableGHSA-jm4g-8rvq-v87j
  • Jenkins XebiaLabs XL Deploy Plugin VendorJenkins Affected 7.5.9 and later; up to 10.0.1 Fixed in — No fix listed CNA
  • com.xebialabs.deployit.ci:deployit-plugin (Maven) Vendor— Affected before 10.0.2 Fixed in 10.0.2 Patch available GHSA-jm4g-8rvq-v87j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:xebialabs_xl_deploy:*:*:*:*:*:jenkins:*:*up to 10.0.1VulnerableJenkins
  • cpe:2.3:a:jenkins:xebialabs_xl_deploy:*:*:*:*:*:jenkins:*:* Versions up to 10.0.1 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-jm4g-8rvq-v87j com.xebialabs.deployit.ci:deployit-plugin (Maven) Fixed in 10.0.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Jenkins XebiaLabs XL Deploy Plugin unspecified

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-04743 Missing authorization in Jenkins XebiaLabs XL Deploy PluginPriority LOW 22
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21664
  2. 2026-10-03 Alias added: GHSA-jm4g-8rvq-v87j

References

Advisory 3

Other 2

  • TI-2021-04745 Cross-site request forgery in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1HIGH 8.8
  • TI-2019-07614 Missing authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 6.5
  • TI-2019-07613 Cross-site request forgery in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.0MEDIUM 6.5
  • TI-2021-04743 Missing authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 4.3
  • TI-2021-04742 Missing authorization in Jenkins XebiaLabs XL Deploy Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences