CVE-2021-22513: 
Java vulnerability analysis and mitigation

CVE-2021-22513 is a Missing Authorization vulnerability discovered in the Micro Focus Application Automation Tools Plugin for Jenkins. The vulnerability affects version 6.7 and earlier versions of the plugin. This security issue was disclosed on April 7, 2021, as part of a broader Jenkins security advisory (Jenkins Advisory).

The vulnerability is classified as a permission check issue with Medium severity (CVSS). The core problem stems from the plugin's failure to perform proper permission checks in methods implementing form validation. This security flaw allows attackers with Overall/Read permission to access functionality that should require higher-level permissions (Jenkins Advisory, NVD).

The vulnerability could allow unauthorized access to sensitive functionality within Jenkins. Specifically, attackers with basic Overall/Read permission could connect to attacker-specified URLs using attacker-specified username and password, bypassing intended permission restrictions (Jenkins Advisory).

The vulnerability requires an attacker to have Overall/Read permission in the Jenkins instance. The exploit can be executed through the form validation methods in the plugin (Jenkins Advisory).

The vulnerability was fixed in OpenText Application Automation Tools Plugin version 6.8. The updated version implements proper permission checks by requiring Overall/Administer permission for the affected form validation methods. Users are advised to upgrade to version 6.8 or later to address this security issue (Jenkins Advisory).

The vulnerability was discovered and reported by Long Nguyen from Viettel Cyber Security, demonstrating the active involvement of the security research community in identifying Jenkins plugin vulnerabilities (Jenkins Advisory).