{"id":"CVE-2021-21626","details":"Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform a permission check in methods implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.","aliases":["GHSA-7j3x-xm4j-jfj7"],"modified":"2026-07-09T00:22:31.669962Z","published":"2021-03-18T14:15:13.490Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2021/03/18/5"},{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2021-03-18/#SECURITY-2041"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/warnings-ng-plugin","events":[{"introduced":"0"},{"last_affected":"32333d6bc764a0ec064add65e9d684e633772cdd"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"8.4.4"}],"source":"CPE_RANGE"}}],"versions":["v8.4.4","v8.4.3","v8.4.2","warnings-ng-8.4.1","warnings-ng-8.4.0","warnings-ng-8.3.0","warnings-ng-8.2.0","warnings-ng-8.1.0","warnings-ng-8.0.0","warnings-ng-8.0.0-beta8","warnings-ng-8.0.0-beta7","warnings-ng-7.3.0","warnings-ng-8.0.0-beta5","warnings-ng-8.0.0-beta3","warnings-ng-7.2.2","warnings-ng-7.2.1","warnings-ng-7.2.0","warnings-ng-7.1.2","warnings-ng-7.1.1","warnings-ng-7.1.0","warnings-ng-7.0.0","warnings-ng-6.1.1","untagged-dfa84d73b8bef5cc810f","warnings-ng-6.1.0","warnings-ng-6.0.4","warnings-ng-6.0.3","untagged-b35eaad4867c611ad5e0","warnings-ng-6.0.2","warnings-ng-6.0.1","warnings-ng-6.0.0","warnings-ng-5.3.0","warnings-ng-5.2.1","warnings-ng-5.2.0","warnings-ng-5.0.0","warnings-ng-4.0.0","warnings-ng-3.0.3","warnings-ng-3.0.2","warnings-ng-3.0.1","warnings-ng-3.0.0","warnings-ng-2.2.1","warnings-ng-2.2.0","warnings-ng-2.1.2","warnings-ng-2.1.1","warnings-ng-2.1.0","warnings-ng-2.0.0","warnings-ng-1.0.1","warnings-ng-1.0.0","warnings-ng-1.0.0-beta10","warnings-ng-1.0.0-beta9","warnings-ng-1.0.0-beta8","warnings-ng-1.0.0-beta7","warnings-ng-1.0.0-beta6","warnings-ng-1.0.0-beta5","warnings-ng-1.0.0-beta4","warnings-ng-1.0.0-beta3","warnings-ng-1.0.0-beta2","warnings-ng-1.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21626.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}