CVE-2021-21602
published 2021-01-13CVE-2021-21602: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
2.23%
80.5th percentile
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | anything_goes_formatter_plugin | — | — |
| jenkins | bumblebee_hp_alm_plugin | — | — |
| jenkins | jenkins | <= 2.263.1 | — |
| jenkins | jenkins | <= 2.274 | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | tics_plugin | — | — |
| jenkins_project | jenkins | unspecified – 2.274 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
osv·2022-05-24·CVSS 6.5
CVE-2021-21615 [MEDIUM] Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.
This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).
Jenkins
GHSA
Arbitrary file read vulnerability in workspace browsers in Jenkins
ghsa·2022-05-24·CVSS 4.3
CVE-2021-21602 [MEDIUM] CWE-59 Arbitrary file read vulnerability in workspace browsers in Jenkins
Arbitrary file read vulnerability in workspace browsers in Jenkins
The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.
This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904).
Jenkins 2.275, LTS 2.263.2 no longer supports symlink
OSV
Arbitrary file read vulnerability in workspace browsers in Jenkins
osv·2022-05-24·CVSS 4.3
CVE-2021-21602 [MEDIUM] Arbitrary file read vulnerability in workspace browsers in Jenkins
Arbitrary file read vulnerability in workspace browsers in Jenkins
The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.
This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904).
Jenkins 2.275, LTS 2.263.2 no longer supports symlink
GHSA
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
ghsa·2022-05-24·CVSS 6.5
CVE-2021-21615 [MEDIUM] CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.
This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).
Jenkins
Jenkins
Jenkins Security Advisory 2021-01-26
vendor_jenkins·2021-01-26·CVSS 6.5
CVE-2021-21602 [MEDIUM] Jenkins Security Advisory 2021-01-26
Title: Jenkins Security Advisory 2021-01-26
Jenkins Security Advisory 2021-01-26
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
Arbitrary file read vulnerability in workspace browsers
SECURITY-2197
/
CVE-2021-21615
Severity (CVSS):
Medium
Description:
Due to a time-of-check to
Jenkins
Jenkins Security Advisory 2021-01-13
vendor_jenkins·2021-01-13·CVSS 5.4
CVE-2018-1000862 [MEDIUM] Jenkins Security Advisory 2021-01-13
Title: Jenkins Security Advisory 2021-01-13
Jenkins Security Advisory 2021-01-13
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Bumblebee HP ALM
Plugin
TICS
Plugin
tracetronic ecu.test
Plugin
Descriptions
XSS vulnerability in notification bar
SECURITY-1889
/
CVE-2021-21603
Severity (CV
Red Hat
jenkins: Arbitrary file read vulnerability in workspace browsers
vendor_redhat·2021-01-13·CVSS 6.5
CVE-2021-21602 [MEDIUM] CWE-59 jenkins: Arbitrary file read vulnerability in workspace browsers
jenkins: Arbitrary file read vulnerability in workspace browsers
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.
Package: jenkins (Red Hat Fuse 7) - Not affected
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-13
Published