{"id":"CVE-2021-21641","aliases":["GHSA-5cxw-8v65-76vf"],"url":"https://o3.security/vulnerability/CVE-2021-21641","summary":"CSRF vulnerability in Jenkins promoted builds Plugin","details":"Jenkins promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.\n\nThese vulnerabilities allow attackers to promote builds.\n\nJenkins promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.\n\nA security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.","published":"2021-04-07T14:15:17.093Z","modified":"2026-07-09T00:22:31.371857Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:promoted-builds","fixedVersion":"3.9.1"}],"fix":{"url":"https://github.com/jenkinsci/promoted-builds-plugin/commit/46086a74891d620042c3d28a19cba3510c5dbf6a","label":"jenkinsci/promoted-builds-plugin@46086a7"},"references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/04/07/2"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-2293"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21641"},{"type":"WEB","url":"https://github.com/jenkinsci/promoted-builds-plugin/commit/46086a74891d620042c3d28a19cba3510c5dbf6a"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/promoted-builds-plugin"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T00:22:31.371857Z"}}