CVE-2021-21682

CWE-425 documents5 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 55.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins Jenkins
Timeline
PublishedOct 6
Latest updateMay 24

Description

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶Mavenorg.jenkins-ci.main:jenkins-core2.304 — 2.315+1
▶NVDjenkins/jenkins2.303.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.314+1

🔴Vulnerability Details

3
OSV
Improper handling of equivalent directory names on Windows in Jenkins↗2022-05-24
▶
GHSA
Improper handling of equivalent directory names on Windows in Jenkins↗2022-05-24
▶
CVEList
CVE-2021-21682: Jenkins 2↗2021-10-06
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2021-10-06↗2021-10-06
▶
CVE-2021-21682 (MEDIUM CVSS 4.3) | Jenkins 2.314 and earlier | cvebase.io