CVE-2021-21690

CRITICAL

Jenkins < 2.303.3 and < 2.319 - Path Traversal via Agent File Path Wrapping

Title source: llm
STIX 2.1

Description

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0050
EPSS Percentile 66.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (3)
jenkins/jenkins < 2.303.3
jenkins/jenkins < 2.319
org.jenkins-ci.main/jenkins-core 0 - 2.303.3Maven
Published Nov 04, 2021
Tracked Since Feb 18, 2026