BIT-jenkins-2021-21695

vendorUSosv

view advisory published 2024-03-06Licence: per source

FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins LTS 2.303.2 and earlier.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-21695US	high8.8OT elevated	2.15% (82nd)	—	2021-11-04
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/11/04/3ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-21695WEB
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan