CVE-2021-21663: 
Java vulnerability analysis and mitigation

CVE-2021-21663 is a security vulnerability identified in the XebiaLabs XL Deploy Plugin for Jenkins, discovered and disclosed on June 10, 2021. The vulnerability affects XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier, specifically related to missing permission checks in form validation methods (Jenkins Advisory).

The vulnerability stems from the absence of proper permission checks in a method implementing form validation within the XebiaLabs XL Deploy Plugin. The issue was partially addressed in version 7.5.9, but the fix implemented an incorrect permission check, which still allowed unauthorized access by non-admin users. The vulnerability has been assigned a High severity CVSS rating (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of Username/password credentials stored in Jenkins (Jenkins Advisory, OSS Security).

The vulnerability has been fixed in XebiaLabs XL Deploy Plugin version 10.0.2, which implements proper POST request requirements and Overall/Administer permission checks for the affected form validation method. Users are strongly advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).