Search for packages
| purl | pkg:maven/org.jenkins-ci.main/jenkins-core@2.303.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-53km-desw-w7d6
Aliases: CVE-2021-21696 GHSA-c5r9-rx53-q3gf |
Protection Mechanism Failure Jenkins does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-7w87-bm8n-bbbr
Aliases: CVE-2021-21688 GHSA-m9hr-259f-2v23 |
Missing Authorization The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo). |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-b4zg-38x9-23dn
Aliases: CVE-2021-21687 GHSA-3q84-vrvx-rfvf |
Missing Authorization Jenkins does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-fvza-3rhj-8kbp
Aliases: CVE-2021-21690 GHSA-97c3-w9cr-6qc2 |
Protection Mechanism Failure Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-h3nf-gwsr-5qf3
Aliases: CVE-2021-21694 GHSA-pgj6-jmj5-wqfx |
Missing Authorization File operations do not check any permissions in Jenkins. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-kf3a-yce1-auh4
Aliases: CVE-2021-21691 GHSA-2c79-h2h5-g3fw |
Incorrect Authorization Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-remx-jas5-1bfm
Aliases: CVE-2021-21692 GHSA-8xg4-xq2v-v6j7 |
Incorrect Authorization FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins only check 'read' agent-to-controller access permission on the source path, instead of 'delete'. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zgtd-8mf6-ruc9
Aliases: CVE-2021-21697 GHSA-cv2w-q8c3-xjv7 |
Incomplete List of Disallowed Inputs Jenkins allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions. |
Affected by 11 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4m6t-zty2-b3d6 | Improper Encoding or Escaping of Output Jenkins accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows. |
CVE-2021-21682
GHSA-6q4g-84f3-mw74 |
| VCID-tdb7-6gx7-1ucr | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The file browser in Jenkins may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files. |
CVE-2021-21683
GHSA-4pw5-r58h-fv24 |