High severity · published Aug 31, 2021
CVE-2021-21678
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Saml · Jenkins
1.1.3 through 2.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21678
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21678
Mailing List
http://www.openwall.com/lists/oss-security/2021/08/31/1
Vendor Advisory
https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2469
More from Saml
7.5
CVE-2025-64131
Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a…
5.9
CVE-2018-1000602
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they…