CVE-2021-21650

Name of the Vulnerable Software and Affected Versions Jenkins S3 publisher Plugin versions 0.11.6 and earlier

Description The issue allows attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled, due to a lack of Run/Artifacts permission checks in various HTTP endpoints and API models.

Recommendations For Jenkins S3 publisher Plugin versions 0.11.6 and earlier, update to version 0.11.7 or later to resolve the issue. As a temporary workaround, consider disabling the optional Run/Artifacts permission to minimize the risk of exploitation.