CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21696 – jenkins: Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin
https://notcve.org/view.php?id=CVE-2021-21696
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process. Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores, no limitan el acceso de lectura/escritura del agente al directorio libs/ dentro de los directorios de construcción cuando son utilizadas las APIs FilePath, permitiendo a atacantes que controlan los procesos del agente reemplazar el código de una biblioteca confiable con una variante modificada. Esto resulta en una ejecución de código sin sandbox en el proceso del controlador de Jenkins An incorrect permissions validation vulnerability was found in Jenkins. An agent process read/write access to the libs/ directory inside build directories when using the FilePath APIs is not limited. • http://www.openwall.com/lists/oss-security/2021/11/04/3 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423 https://access.redhat.com/security/cve/CVE-2021-21696 https://bugzilla.redhat.com/show_bug.cgi?id=2020344 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21695 – jenkins: FilePath#listFiles lists files outside directories with agent read access when following symbolic links.
https://notcve.org/view.php?id=CVE-2021-21695
FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. FilePath#listFiles lista los archivos fuera de los directorios a los que agentes pueden acceder cuando siguen enlaces simbólicos en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores An incorrect permissions validation vulnerability was found in Jenkins. The FilePath#listFiles lists files outside directories with agent read access when following symbolic links. This may allow an attacker to get access to restricted data. • http://www.openwall.com/lists/oss-security/2021/11/04/3 https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://access.redhat.com/security/cve/CVE-2021-21695 https://bugzilla.redhat.com/show_bug.cgi?id=2020343 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21694 – jenkins: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions
https://notcve.org/view.php?id=CVE-2021-21694
FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, y FilePath#get*DiskSpace no comprueban ningún permiso en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores An incorrect permissions validation vulnerability was found in Jenkins. The FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions, which may allow an attacker who has access to any of these operations to be able to read and write arbitrary files on the Jenkins controller file system. • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://access.redhat.com/security/cve/CVE-2021-21694 https://bugzilla.redhat.com/show_bug.cgi?id=2020342 • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21692 – jenkins: The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path
https://notcve.org/view.php?id=CVE-2021-21692
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'. FilePath#renameTo y FilePath#moveAllChildrenTo en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores ,sólo comprueban el permiso de acceso de agente a controlador "read" en la ruta de origen, en lugar de "delete" An incorrect permissions validation vulnerability was found in Jenkins. The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path which may allow an attacker who has access to these operations to be able to read and write to arbitrary files on the Jenkins controller file system. • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://access.redhat.com/security/cve/CVE-2021-21692 https://bugzilla.redhat.com/show_bug.cgi?id=2020339 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21691 – jenkins: Creating symbolic links is possible without the symlink permission
https://notcve.org/view.php?id=CVE-2021-21691
Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. Una creación de enlaces simbólicos es posible sin el permiso de control de acceso del agente-controlador "symlink" en Jenkins versiones 2.318 y anteriores, LTS versiones 2.303.2 y anteriores A vulnerability was found in Jenkins which failed to correctly validate permissions. This flaw allowed any user to create symbolic links regardless if they had the symlink permission. It may allow an attacker to read and write to arbitrary files on the Jenkins controller file system. • https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 https://access.redhat.com/security/cve/CVE-2021-21691 https://bugzilla.redhat.com/show_bug.cgi?id=2020338 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-276: Incorrect Default Permissions •