CVE-2021-21664: 
Java vulnerability analysis and mitigation

CVE-2021-21664 is a security vulnerability identified in the XebiaLabs XL Deploy Plugin for Jenkins, discovered and disclosed on June 10, 2021. The vulnerability is characterized by an incorrect permission check in a method implementing form validation, affecting versions up to and including 10.0.1 of the plugin (Jenkins Advisory).

The vulnerability is classified as CWE-863 (Incorrect Authorization) and is part of a broader security issue (SECURITY-1982) that includes multiple vulnerabilities. The issue stems from an incorrect implementation of permission checks in the form validation method, where a permission check was added in version 7.5.9 but was configured for the wrong permission level, allowing non-administrator users to access sensitive functionality (Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, potentially leading to the capture of username/password credentials stored in Jenkins (Jenkins Advisory).

The vulnerability was fixed in XebiaLabs XL Deploy Plugin version 10.0.2, which implements proper permission checks requiring Overall/Administer permission for the affected form validation method and mandates POST requests. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).