CVE-2021-21624: 
Java vulnerability analysis and mitigation

CVE-2021-21624 affects the Role-based Authorization Strategy Plugin in Jenkins, discovered and disclosed on March 18, 2021. This vulnerability impacts versions 3.1 and earlier of the plugin, which is used for managing access permissions in Jenkins environments (Jenkins Advisory).

The vulnerability stems from incorrect permission checks in the Role-based Authorization Strategy Plugin when determining item accessibility in hierarchical structures. In Jenkins, items like jobs can be organized hierarchically using the Folders Plugin. While the system expects items to be accessible only if all their ancestors are accessible, the affected versions fail to properly enforce this hierarchy of permissions (Jenkins Advisory, OSS Security). The vulnerability is rated as Medium severity according to CVSS scoring.

This vulnerability allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders. This breaks the intended hierarchical permission model and could lead to unauthorized access to sensitive Jenkins jobs and resources (Jenkins Advisory).

The vulnerability was fixed in Role-based Authorization Strategy Plugin version 3.1.1, which properly requires Item/Read permission on parent items to grant Item/Read permission on individual items. For users unable to update immediately, a workaround is available: do not grant permissions on individual items to users who don't have access to parent items. Additionally, the fix can be disabled by setting the Java system property com.michelin.cio.hudson.plugins.rolestrategy.RoleMap.checkParentPermissions to false (Jenkins Advisory).