Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.1
CVSSv3

CVE-2021-21687

Published: 04/11/2021 Updated: 22/11/2023
CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10
CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9
VMScore: 570
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Subscribe to Jenkins

Vulnerability Summary

Jenkins 2.318 and previous versions, LTS 2.303.2 and previous versions does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

jenkins jenkins

Vendor Advisories

Arch Linux Issues:
A security issue has been found in Jenkins before version 2319 FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link This allows agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems ...

References

CWE-862https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455https://nvd.nist.govhttps://security.archlinux.org/CVE-2021-21687
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48693CVE-2024-30851CVE-2024-34460CVE-2024-2887localCVE-2024-27956remote code executionCVE-2024-34475privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook