CVE-2021-21640: Input Validation
A flaw was found in Jenkins. Due to lack of validation of the newly created view name, an attackers with View/Create permission are allowed to create views with invalid or already-used names.
Other sources
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name, allowing attackers with View/Create permission to create views with invalid or already-used names.
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value.
This allows attackers with View/Create permission to create views with invalid or already-used names.
Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation and view creation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.277.3.1620393611-1.el8 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.289.1.1624020353-1.el8 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.277.2 - Upgrade
Upgrade
maven/org.jenkins-ci.main:jenkins-coreto a version that resolves this vulnerability.Fixed in 2.287 - Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2.287 - Upgrade
Upgrade
redhat/jenkins LTSto a version that resolves this vulnerability.Fixed in 2.277.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-21640.
What is the severity of CVE-2021-21640?
The severity of CVE-2021-21640 is medium (severity value: 4).
What is the description of CVE-2021-21640?
CVE-2021-21640 is a vulnerability in Jenkins that allows attackers with View/Create permission to create views with invalid or already-used names due to lack of validation of the newly created view name.
How does CVE-2021-21640 affect Jenkins?
CVE-2021-21640 affects Jenkins versions 2.286 and earlier, LTS 2.277.1 and earlier.
How can I fix CVE-2021-21640?
To fix CVE-2021-21640, update Jenkins to version 2.287 or LTS 2.277.2 or newer.