CVE-2021-21690

CWE-22 — Path TraversalCWE-693CWE-79 — Cross-site Scripting (XSS)7 documents6 sources
Severity
9.8CRITICAL
EPSS
0.5%
top 33.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins JenkinsJenkins Project Jenkins
Timeline
PublishedNov 4
Latest updateMay 24

Description

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDjenkins/jenkins< 2.303.3+1
▶Mavenorg.jenkins-ci.main:jenkins-core2.304 — 2.319+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.318+1

🔴Vulnerability Details

4
OSV
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins↗2022-05-24
▶
GHSA
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins↗2022-05-24
▶
GHSA
OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend↗2022-01-21
▶
CVEList
CVE-2021-21690: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2↗2021-11-04
▶

📋Vendor Advisories

2
Red Hat
jenkins: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path↗2021-11-04
▶
Jenkins
Jenkins Security Advisory 2021-11-04↗2021-11-04
▶
CVE-2021-21690 (CRITICAL CVSS 9.8) | Agent processes are able to complet | cvebase.io