jenkins: Agent-to-controller access control allows reading/writing most content of build directories

🗓️ 01 Dec 2021 12:28:59Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 7 Views

Jenkins agent-to-controller access control flaw lets an agent read and write most build directories.

Reporter	Title	Published	Views	Family All 48
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21697	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the Jenkins automation server, related to the use of an incomplete blacklist, allows a malicious actor to read and write the contents of any build catalog.	16 Dec 202100:00	–	bdu_fstec
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.569 (RHSA-2021:4827)	4 Dec 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.303.3.1637597018-1.el8	jenkins-2.303.3.1637597018-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-21697
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21697
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2021-11-04/

21 Mar 2026 05:05Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.4

CVSS 3.19.1

EPSS0.0155

Jenkins vulnerability Agent to controller Build directories Read access Write access Pipeline metadata