CVE-2021-21625
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
- Record
CVE-2021-21625- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
- Record
CVE-2021-21625- Updated
- 2026-11-02
EUVDEUVD-2022-4452 No score
Jenkins CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins in some circumstances.
- Record
EUVD-2022-4452- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jwr9-h4jm-c9ch
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:
- Amazon Elastic Container Service (ECS) / Fargate
- AWS Parameter Store Build Wrapper
- AWS SAM\n\nFurther plugins may use this helper method as well without performing a permission check themselves.
Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.
CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.
- Record
GHSA-jwr9-h4jm-c9ch- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-jwr9-h4jm-c9ch
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:
- Amazon Elastic Container Service (ECS) / Fargate
- AWS Parameter Store Build Wrapper
- AWS SAM\n\nFurther plugins may use this helper method as well without performing a permission check themselves.
Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.
CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.
- Record
GHSA-jwr9-h4jm-c9ch- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:aws-credentialsMaven |
through 1.28 | 1.28.1 |
org.jenkins-ci.plugins:aws-credentialsMaven |
before 1.28.1, plus listed versions 1.101.111.11.11.121.13 Show 17 moreShow less1.141.151.161.171.181.191.201.211.221.231.241.251.261.271.281.81.9 |
1.28.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21625 is a medium vulnerability (CVSS 4.3) in Jenkins Cloudbees Aws Credentials, published March 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in org.jenkins-ci.plugins:aws-credentials 1.28.1.