gsd-2021-21690
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-21690",
"description": "Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.",
"id": "GSD-2021-21690",
"references": [
"https://access.redhat.com/errata/RHSA-2021:4833",
"https://access.redhat.com/errata/RHSA-2021:4829",
"https://access.redhat.com/errata/RHSA-2021:4827",
"https://access.redhat.com/errata/RHSA-2021:4801",
"https://access.redhat.com/errata/RHSA-2021:4799",
"https://security.archlinux.org/CVE-2021-21690"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-21690"
],
"details": "Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.",
"id": "GSD-2021-21690",
"modified": "2023-12-13T01:23:11.101483Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "jenkinsci-cert@googlegroups.com",
"ID": "CVE-2021-21690",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Jenkins",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "unspecified",
"version_value": "2.318"
}
]
}
}
]
},
"vendor_name": "Jenkins project"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455",
"refsource": "MISC",
"url": "https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,2.319)",
"affected_versions": "All versions before 2.319",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-693",
"CWE-937"
],
"date": "2021-11-09",
"description": "Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins.",
"fixed_versions": [],
"identifier": "CVE-2021-21690",
"identifiers": [
"CVE-2021-21690"
],
"not_impacted": "",
"package_slug": "maven/org.jenkins-ci.main/jenkins-core",
"pubdate": "2021-11-04",
"solution": "Unfortunately, there is no solution available yet.",
"title": "Protection Mechanism Failure",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-21690",
"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455"
],
"uuid": "e98e2d6e-39ad-4dac-85bd-9356f770acb3"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.303.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.319",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "jenkinsci-cert@googlegroups.com",
"ID": "CVE-2021-21690"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
},
"lastModifiedDate": "2023-11-22T21:23Z",
"publishedDate": "2021-11-04T17:15Z"
}
}
}
Loading...