CVE-2021-21640 — Improper Handling of Inconsistent Structural Elements in Project Jenkins

CWE-240 — Improper Handling of Inconsistent Structural ElementsCWE-20 — Improper Input Validation6 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.7%
top 27.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins
Timeline
PublishedApr 7
Latest updateMay 24

Description

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDjenkins/jenkins2.277.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.286+1

🔴Vulnerability Details

3
GHSA
View name validation bypass in Jenkins↗2022-05-24
▶
OSV
View name validation bypass in Jenkins↗2022-05-24
▶
CVEList
CVE-2021-21640: Jenkins 2↗2021-04-07
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2021-04-07↗2021-04-07
▶
Red Hat
jenkins: view name validation bypass↗2021-04-07
▶