by Kastro
Paper/Archive/CVE-2021-21690

CVE-2021-21690

Jenkins project Jenkins — Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 a…

EPSS 3%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.9.849 × 2017.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

Affected

ProductAffectedFixed inSource
Jenkinsunspecified – 2.318–CNA
Jenkinsunspecified – LTS 2.303.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refjenkins.io/security/advisory/2021-11-04/#SECURITY-2455