Description

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Remediation

References

CVE-2021-21615

Related Vulnerabilities

WordPress Plugin WP Business Intelligence Lite SQL Injection (1.6.1)

WordPress Plugin Image Optimizer, Resizer and CDN-Sirv Arbitrary File Upload (7.2.6)

WordPress Plugin Newsletter Manager Multiple Cross-Site Scripting Vulnerabilities (1.0.1)

Tornado URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-28370)

OpenSSL Numeric Errors Vulnerability (CVE-2016-2181)

Severity

Medium

Classification

CVE-2021-21615 CWE-367 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities