CVE-2021-21683 — Path Traversal in Project Jenkins

CWE-22 — Path Traversal5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
1.7%
top 17.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins
Timeline
PublishedOct 6
Latest updateMay 24

Description

The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDjenkins/jenkins2.303.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.314+1

🔴Vulnerability Details

3
OSV
Path traversal vulnerability on Windows in Jenkins↗2022-05-24
▶
GHSA
Path traversal vulnerability on Windows in Jenkins↗2022-05-24
▶
CVEList
CVE-2021-21683: The file browser in Jenkins 2↗2021-10-06
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2021-10-06↗2021-10-06
▶
CVE-2021-21683 — Path Traversal in Project Jenkins | cvebase