PT-2021-14649 · Jenkins · Jenkins

Wadeck Follonier · Published 2021-01-13 · Updated 2024-03-06 · CVE-2021-21606

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.274 and earlier Jenkins LTS versions 2.263.1 and earlier

Description The issue arises from improper validation of the format of a provided fingerprint ID when checking for its existence. This allows an attacker to check for the existence of XML files with a short path. The vulnerability is related to a REST API endpoint that does not fully validate the provided fingerprint ID before checking for the XML metadata on the controller file system. This enables attackers with Overall/Read permission to check for the existence of XML files on the controller file system where the relative path can be constructed as 32 characters.

Recommendations For Jenkins versions 2.274 and earlier, update to version 2.275 or later. For Jenkins LTS versions 2.263.1 and earlier, update to version 2.263.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-JENKINS-2021-21606

CVE-2021-21606

GHSA-F585-9FW3-RJ2M

RHSA-2021:0423

RHSA-2021:0429

RHSA-2021:0637

Affected Products

Jenkins

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-21606 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21606 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f585-9fw3-rj2m · Vendor Advisory
• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2023 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2021-21606 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f576b2eb4375f2bb076ce477cee27a946b65f22a · Note
• https://t.me/cibsecurity/22080 · Telegram Post