GHSA-2C79-H2H5-G3FW Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

🗓️ 24 May 2022 19:19:44Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Vulnerabilities in Jenkins path filtering allow agent access to controller files; fixed in version 2.319 and long-term support 2.303.3.

Reporter	Title	Published	Views	Family All 48
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21691	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the Jenkins automation server, related to deficiencies in the authentication mechanism, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	20 Dec 202100:00	–	bdu_fstec
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.569 (RHSA-2021:4827)	4 Dec 202100:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21691
github	www.github.com/jenkinsci/jenkins/commit/63cde2daadc705edf086f2213b48c8c547f98358
github	www.github.com/jenkinsci/jenkins
jenkins	www.jenkins.io/security/advisory/2021-11-04/

16 Feb 2024 08:08Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19

EPSS0.02034