CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21693 – jenkins: When creating temporary files, permission to create files is only checked after they’ve been created.
https://notcve.org/view.php?id=CVE-2021-21693
When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. Cuando son creados archivos temporales, el acceso de agente a controlador para crear esos archivos sólo se comprueba después de haberlos creado en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores An incorrect permissions validation vulnerability was found in Jenkins. The permissions to create temporary files are only checked after they have been created. This may allow an attacker to get access to restricted data. • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://access.redhat.com/security/cve/CVE-2021-21693 https://bugzilla.redhat.com/show_bug.cgi?id=2020341 • CWE-276: Incorrect Default Permissions CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21683
https://notcve.org/view.php?id=CVE-2021-21683
The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files. El navegador de archivos en Jenkins versiones 2.314 y anteriores, LTS versiones 2.303.1 y anteriores, puede interpretar algunas rutas de archivos como absolutas en Windows, resultando en una vulnerabilidad de salto de ruta que permite a atacantes con permiso de Overall/Read (controlador de Windows) o permiso de Job/Workspace (agentes de Windows) obtener el contenido de archivos arbitrarios • http://www.openwall.com/lists/oss-security/2021/10/06/1 https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2481 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21682
https://notcve.org/view.php?id=CVE-2021-21682
Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows. Jenkins versiones 2.314 y anteriores, LTS versiones 2.303.1 y anteriores, aceptan nombres de trabajos y otras entidades con un carácter de punto al final, reemplazando potencialmente la configuración y los datos de otras entidades en Windows • http://www.openwall.com/lists/oss-security/2021/10/06/1 https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2424 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21671 – jenkins: session fixation vulnerability
https://notcve.org/view.php?id=CVE-2021-21671
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. Jenkins versiones 2.299 y anteriores, versiones LTS 2.289.1 y anteriores no invalidan la sesión anterior al iniciar sesión Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user. • http://www.openwall.com/lists/oss-security/2021/06/30/1 https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371 https://access.redhat.com/security/cve/CVE-2021-21671 https://bugzilla.redhat.com/show_bug.cgi?id=2007750 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21670 – jenkins: improper permission checks allow canceling queue items and aborting builds
https://notcve.org/view.php?id=CVE-2021-21670
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins versiones 2.299 y anteriores, versiones LTS 2.289.1 y anteriores, permiten a usuarios cancelar elementos de la cola y abortar construcciones de trabajos para los que tienen permiso de Elemento/Cancelación incluso cuando no tienen permiso de Elemento/Lectura Incorrect Authorization vulnerability was found in Jenkins. Users with Item/Cancel permission are able to cancel queue items and abort builds of jobs even when they do not have Item/Read permission. • http://www.openwall.com/lists/oss-security/2021/06/30/1 https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278 https://access.redhat.com/security/cve/CVE-2021-21670 https://bugzilla.redhat.com/show_bug.cgi?id=2007749 • CWE-863: Incorrect Authorization •