#VU57983 Protection Mechanism Failure in Jenkins and Jenkins LTS - CVE-2021-21690

Vulnerability identifier: #VU57983

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-21690

CWE-ID: CWE-693

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jenkins
Server applications / Application servers
Jenkins LTS
Server applications / Application servers

Vendor: Jenkins

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path. An attacker can bypass implemented security restrictions and elevate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Jenkins: 2.0 - 2.318

Jenkins LTS: 1.409.1 - 2.303.2

---

External links
https://jenkins.io/security/advisory/2021-11-04/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.