Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/57594?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/57594?format=api", "vulnerability_id": "VCID-7fep-hazu-2fgt", "summary": "Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin\nJenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file `com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml` on the Jenkins controller as part of its configuration.\n\nThese credentials can be viewed by users with access to the Jenkins controller file system.\n\nJenkins Bumblebee HP ALM Plugin 4.1.6 stores credentials encrypted once its configuration is saved again.", "aliases": [ { "alias": "CVE-2021-21614" }, { "alias": "GHSA-8v72-qr3h-c6rv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/388390?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=armhf&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=armhf&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388392?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=mips64&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=mips64&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388394?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=s390x&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=s390x&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388395?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=x86&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=x86&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388396?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=x86_64&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=x86_64&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388389?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=aarch64&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=aarch64&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388391?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=armv7&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=armv7&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/388393?format=api", "purl": "pkg:apk/alpine/jenkins@2.275-r0?arch=ppc64le&distroversion=v3.12&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/jenkins@2.275-r0%3Farch=ppc64le&distroversion=v3.12&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/83882?format=api", "purl": "pkg:maven/org.jenkins-ci.plugins/bumblebee@4.1.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/bumblebee@4.1.6" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/143715?format=api", "purl": "pkg:maven/org.jenkins-ci.plugins/bumblebee@4.1.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7fep-hazu-2fgt" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/bumblebee@4.1.5" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21614", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.0147", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01372", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01465", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01474", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01477", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01485", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01476", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01469", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01463", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.0146", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01365", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01377", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01382", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01392", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01396", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01385", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.01378", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00011", "scoring_system": "epss", "scoring_elements": "0.0138", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21614" }, { "reference_url": "https://github.com/jenkinsci/bumblebee-plugin", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/bumblebee-plugin" }, { "reference_url": "https://github.com/jenkinsci/bumblebee-plugin/commit/7faf4bd6e702726bb7542f370cbdedcbfa340443", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jenkinsci/bumblebee-plugin/commit/7faf4bd6e702726bb7542f370cbdedcbfa340443" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21614", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21614" }, { "reference_url": "https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156" }, { "reference_url": "https://github.com/advisories/GHSA-8v72-qr3h-c6rv", "reference_id": "GHSA-8v72-qr3h-c6rv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8v72-qr3h-c6rv" } ], "weaknesses": [ { "cwe_id": 522, "name": "Insufficiently Protected Credentials", "description": "The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7fep-hazu-2fgt" }