jenkins: Missing permission check for paths with specific prefix

🗓️ 17 Feb 2021 19:06:25Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Jenkins versions 2.274 and earlier and LTS 2.263.1 fail to enforce Overall/Read for some URL prefixes.

Reporter	Title	Published	Views	Family All 40
AlpineLinux	CVE-2021-21609	13 Jan 202115:55	–	alpinelinux
ArchLinux	[ASA-202101-41] jenkins: multiple issues	20 Jan 202100:00	–	archlinux
Circl	CVE-2021-21609	13 Jan 202119:25	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.222.43.0.1 / 2.249.30.0.1 / 2.263.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-01-13)	29 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (d6f76976-e86d-4f9a-9362-76c849b10db2)	14 Jan 202100:00	–	nessus
Tenable Nessus	Jenkins < 2.263.2 LTS / 2.275 Multiple Vulnerabilities	22 Jan 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	18 Feb 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	3 Mar 202100:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	3 Mar 202100:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	6 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.263.3.1612434510-1.el8	jenkins-2.263.3.1612434510-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-21609
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21609
cve	www.cve.org/CVERecord

26 Jun 2026 19:36Current

5.8Medium risk

Vulners AI Score5.8

CVSS 25

CVSS 3.15.3

EPSS0.01307

Jenkins permission check read permission url prefixes unrestricted access