CVE-2021-21615
published 2021-01-26CVE-2021-21615: Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use…
PriorityP432medium5.3CVSS 3.1
AVNACHPRLUINSUCHINAN
EPSS
0.90%
55.1th percentile
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | jenkins | < 2.263.3 | 2.263.3 |
| jenkins | jenkins | < 2.276 | 2.276 |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins_project | jenkins | — | — |
| jenkins_project | jenkins | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
osv·2022-05-24·CVSS 6.5
CVE-2021-21615 [MEDIUM] Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.
This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).
Jenkins
GHSA
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
ghsa·2022-05-24·CVSS 6.5
CVE-2021-21615 [MEDIUM] CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.
This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).
Jenkins
Jenkins
Jenkins Security Advisory 2021-01-26
vendor_jenkins·2021-01-26·CVSS 6.5
CVE-2021-21602 [MEDIUM] Jenkins Security Advisory 2021-01-26
Title: Jenkins Security Advisory 2021-01-26
Jenkins Security Advisory 2021-01-26
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
Arbitrary file read vulnerability in workspace browsers
SECURITY-2197
/
CVE-2021-21615
Severity (CVSS):
Medium
Description:
Due to a time-of-check to
Red Hat
jenkins: Filesystem traversal by privileged users
vendor_redhat·2021-01-26·CVSS 5.3
CVE-2021-21615 [MEDIUM] CWE-22 jenkins: Filesystem traversal by privileged users
jenkins: Filesystem traversal by privileged users
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
Package: jenkins (Red Hat Fuse 7) - Not affected
Package: jenkins (Red Hat OpenShift Container Platform 3.11) - Will not fix
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-26
Published