jenkins: FilePath#unzip and FilePath#untar were not subject to any access control

🗓️ 29 Nov 2021 10:40:21Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

Jenkins vulnerability: FilePath unzip and untar lack access control, enabling arbitrary controller file access.

Reporter	Title	Published	Views	Family All 49
FreeBSD	jenkins -- multiple vulnerabilities	4 Nov 202100:00	–	freebsd
AlpineLinux	CVE-2021-21689	4 Nov 202117:15	–	alpinelinux
ArchLinux	[ASA-202111-1] jenkins: multiple issues	5 Nov 202100:00	–	archlinux
BDU FSTEC	The vulnerability of the Jenkins automation server, related to the absence of authentication procedures, allows attackers to compromise the confidentiality and integrity of the protected information.	4 Jan 202200:00	–	bdu_fstec
Circl	CVE-2021-21689	4 Nov 202119:25	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center < 2.277.43.0.2 / 2.303.3.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-11-04)	19 Nov 202100:00	–	nessus
Tenable Nessus	FreeBSD : jenkins -- multiple vulnerabilities (2bf56269-90f8-4a82-b82f-c0e289f2a0dc)	5 Nov 202100:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.303.3 / Jenkins weekly < 2.319 Multiple Vulnerabilities	4 Nov 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.6.51 (RHSA-2021:4799)	3 Dec 202100:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.38 (RHSA-2021:4801)	2 Dec 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins	2.303.3.1637595827-1.el8	jenkins-2.303.3.1637595827-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-21689
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21689
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2021-11-04/

21 Mar 2026 05:05Current

5.8Medium risk

Vulners AI Score5.8

CVSS 26.4

CVSS 3.19.1

EPSS0.01416

jenkins vulnerability file path unzip file path untar access control flaw controller file access