Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.

Remediation

References

CVE-2021-21605

Related Vulnerabilities

MySQL CVE-2018-3285 Vulnerability (CVE-2018-3285)

WordPress Plugin Yoast SEO Cross-Site Scripting (2.1.1)

ReviveAdserver Incorrect Authorization Vulnerability (CVE-2020-8142)

Atlassian Jira Missing Authorization Vulnerability (CVE-2019-20407)

WordPress Plugin Mitsol Social Post Feed Cross-Site Scripting (1.10)

Severity

High

Classification

CVE-2021-21605 CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities