CVE-2021-21677
RCE vulnerability in Jenkins Code Coverage API Plugin
8.8
HIGH
CVSS 3.1
EPSS 1.2%
Description
Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply [JEP-200 deserialization protection](https://github.com/jenkinsci/jep/tree/master/jep/200) to Java objects it deserializes from disk. This results in a remote code execution (RCE) vulnerability exploitable by attackers able to control agent processes. Jenkins Code Coverage API Plugin 1.4.1 configures its Java object deserialization to only deserialize safe types.
How to fix CVE-2021-21677
To remediate CVE-2021-21677, upgrade the affected package to a fixed version below.
- —upgrade to 1.4.1 or later
Is CVE-2021-21677 being exploited?
Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1.4.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |