CVE-2021-21686: Path Traversal
File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.
Other sources
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21686?
CVE-2021-21686 is a vulnerability in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier, which allows operations to follow symbolic links to outside allowed directories.
How does CVE-2021-21686 impact Jenkins?
CVE-2021-21686 allows attackers to exploit file path filters in Jenkins, potentially leading to unauthorized access to sensitive information or remote code execution.
What is the severity of CVE-2021-21686?
CVE-2021-21686 has a severity rating of 8.1 (high).
Is there a fix for CVE-2021-21686?
Yes, the fix for CVE-2021-21686 is available in Jenkins version 2.319 and Jenkins LTS version 2.303.3.
Where can I find more information about CVE-2021-21686?
You can find more information about CVE-2021-21686 on the Jenkins Security Advisory page (https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455) and the Red Hat Errata pages (https://access.redhat.com/errata/RHSA-2021:4833, https://access.redhat.com/errata/RHSA-2021:4829).