Information disclosure in Jenkins
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-21615 |
| CWE-ID | CWE-367 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Jenkins Server applications / Application servers Jenkins LTS Server applications / Application servers |
| Vendor | Jenkins |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Time-of-check Time-of-use (TOCTOU) Race Condition
EUVDB-ID: #VU50020
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-21615
CWE-ID:
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to a race condition in the file browser for workspaces. A remote user with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, can create symbolic links that allow them to access files outside workspaces using the workspace browser.
Note, the vulnerability is caused by incorrect patch for #VU49527
MitigationInstall updates from vendor's website.
Vulnerable software versionsJenkins: 2.0 - 2.275
Jenkins LTS: 2.7.1 - 2.263.2
External linkshttp://jenkins.io/security/advisory/2021-01-26/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
