GHSA-xv69-6rf3-w5g2

GitHub Security Advisory

Missing permission check in Jenkins Cloud Statistics Plugin

✓ GitHub Reviewed MODERATE Has CVE

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.

Jenkins Cloud Statistics Plugin 0.27 requires Overall/Administer permission to access provisioning exception error messages.

Maven org.jenkins-ci.plugins:cloud-stats

Affected versions: 0 (fixed in 0.27)

CVE-2021-21631

GHSA ID

GHSA-xv69-6rf3-w5g2

Published

May 24, 2022 5:45 PM

Last Modified

October 27, 2023 1:56 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:cloud-stats

GitHub Reviewed

✓ Yes

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.