CVSS: 9.1EPSS: 2%CPEs: 2EXPL: 0CVE-2021-21689 – jenkins: FilePath#unzip and FilePath#untar were not subject to any access control
https://notcve.org/view.php?id=CVE-2021-21689
04 Nov 2021 — FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. FilePath#unzip y FilePath#untar no estaban sujetos a ningún control de acceso de agente a controlador en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores An incorrect access control vulnerability was found in Jenkins. The FilePath#unzip and FilePath#untar were not subjected to any access control. An attacker with access to FilePath#unzip ... • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21688 – jenkins: FilePath#reading(FileVisitor) does not reject any operations allowing users to have unrestricted read access
https://notcve.org/view.php?id=CVE-2021-21688
04 Nov 2021 — The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo). Un control de seguridad agente-a-controlador FilePath#reading(FileVisitor) en Jenkins 2.318 y anteriores, LTS versiones 2.303.2 y anteriores, no rechaza ninguna operación, permitiendo a usuarios tener acceso de lectura sin restricciones ... • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-862: Missing Authorization •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21687 – jenkins: FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link
https://notcve.org/view.php?id=CVE-2021-21687
04 Nov 2021 — Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar. Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores, no comprueban el acceso agente-controlador para crear enlaces simbólicos cuando se desarchiva un enlace simbólico en FilePath#untar An incorrect permissions validation vulnerability was found in Jenkins. The FilePath#untar does not check permission to create symbolic ... • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-862: Missing Authorization •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21686 – jenkins: File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories
https://notcve.org/view.php?id=CVE-2021-21686
04 Nov 2021 — File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. Los filtros de rutas de archivos en el subsistema de seguridad agente-a-controlador de Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores, no canonizan las rutas, permitiendo que las operaciones sigan enlaces simbólicos a directorios no permitidos A link following vul... • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21685 – jenkins: FilePath#mkdirs does not check permission to create parent directories
https://notcve.org/view.php?id=CVE-2021-21685
04 Nov 2021 — Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores, no comprueban el acceso de agente a controlador para crear directorios padre en FilePath#mkdirs An incorrect permissions validation vulnerability was found in Jenkins. The FilePath#mkdirs does not check permission to create parent directories, which may allow an attacker who controls the agent p... • http://www.openwall.com/lists/oss-security/2021/11/04/3 • CWE-281: Improper Preservation of Permissions CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2021-21693 – jenkins: When creating temporary files, permission to create files is only checked after they’ve been created.
https://notcve.org/view.php?id=CVE-2021-21693
04 Nov 2021 — When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. Cuando son creados archivos temporales, el acceso de agente a controlador para crear esos archivos sólo se comprueba después de haberlos creado en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores An incorrect permissions validation vulnerability was found in Jenkins. The permissions to create temporary files ... • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 • CWE-276: Incorrect Default Permissions CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21683
https://notcve.org/view.php?id=CVE-2021-21683
06 Oct 2021 — The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files. El navegador de archivos en Jenkins versiones 2.314 y anteriores, LTS versiones 2.303.1 y anteriores, puede interpretar algunas rutas de archivos como absolutas en Windows, resultand... • http://www.openwall.com/lists/oss-security/2021/10/06/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 1%CPEs: 3EXPL: 0CVE-2021-21682
https://notcve.org/view.php?id=CVE-2021-21682
06 Oct 2021 — Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows. Jenkins versiones 2.314 y anteriores, LTS versiones 2.303.1 y anteriores, aceptan nombres de trabajos y otras entidades con un carácter de punto al final, reemplazando potencialmente la configuración y los datos de otras entidades en Windows • http://www.openwall.com/lists/oss-security/2021/10/06/1 •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2021-21671 – jenkins: session fixation vulnerability
https://notcve.org/view.php?id=CVE-2021-21671
30 Jun 2021 — Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. Jenkins versiones 2.299 y anteriores, versiones LTS 2.289.1 y anteriores no invalidan la sesión anterior al iniciar sesión Session fixation vulnerability was found in Jenkins. The existing session on login process are not invalidated and this allows an attacker to gain potentially additional access on Jenkins by using social engineering attack techniques on a target user. Red Hat Advanced Cluster Management... • http://www.openwall.com/lists/oss-security/2021/06/30/1 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 2%CPEs: 2EXPL: 0CVE-2021-21670 – jenkins: improper permission checks allow canceling queue items and aborting builds
https://notcve.org/view.php?id=CVE-2021-21670
30 Jun 2021 — Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins versiones 2.299 y anteriores, versiones LTS 2.289.1 y anteriores, permiten a usuarios cancelar elementos de la cola y abortar construcciones de trabajos para los que tienen permiso de Elemento/Cancelación incluso cuando no tienen permiso de Elemento/Lectura Incorrect Authorization vulnerability was f... • http://www.openwall.com/lists/oss-security/2021/06/30/1 • CWE-863: Incorrect Authorization •