Description

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

Remediation

References

CVE-2021-21686

Related Vulnerabilities

WordPress Plugin Easy Forms for Mailchimp Cross-Site Scripting (5.0.6)

WebLogic CVE-2021-2109 Vulnerability (CVE-2021-2109)

Envoy Proxy Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2019-18836)

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-36398)

WordPress 3.8.x Same Origin Method Execution (SOME) Vulnerability (3.8 - 3.8.13)

Severity

High

Classification

CVE-2021-21686 CWE-59 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities