Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21648 State: PUBLISHED Published: 2021-05-11T14:15:20 Last Updated: 2024-08-03T18:16:23.936Z Vendors: Jenkins project Products: Jenkins Credentials Plugin Description: Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2349
CVE ID: CVE-2021-21649 State: PUBLISHED Published: 2021-05-11T14:15:21 Last Updated: 2024-08-03T18:16:23.935Z Vendors: Jenkins project Products: Jenkins Dashboard View Plugin Description: Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2233
CVE ID: CVE-2021-21650 State: PUBLISHED Published: 2021-05-11T14:15:21 Last Updated: 2024-08-03T18:23:27.382Z Vendors: Jenkins project Products: Jenkins S3 publisher Plugin Description: Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2200
CVE ID: CVE-2021-21651 State: PUBLISHED Published: 2021-05-11T14:15:22 Last Updated: 2024-08-03T18:23:27.398Z Vendors: Jenkins project Products: Jenkins S3 publisher Plugin Description: Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to obtain the list of configured profiles. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2201
CVE ID: CVE-2021-21652 State: PUBLISHED Published: 2021-05-11T14:15:23 Last Updated: 2024-08-03T18:23:27.383Z Vendors: Jenkins project Products: Jenkins Xray - Test Management for Jira Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2251%20%281%29
CVE ID: CVE-2021-21653 State: PUBLISHED Published: 2021-05-11T14:15:23 Last Updated: 2024-08-03T18:23:27.391Z Vendors: Jenkins project Products: Jenkins Xray - Test Management for Jira Plugin Description: Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2251%20%282%29
CVE ID: CVE-2021-21654 State: PUBLISHED Published: 2021-05-11T14:15:24 Last Updated: 2024-08-03T18:23:27.372Z Vendors: Jenkins project Products: Jenkins P4 Plugin Description: Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2327
CVE ID: CVE-2021-21655 State: PUBLISHED Published: 2021-05-11T14:15:25 Last Updated: 2024-08-03T18:23:27.403Z Vendors: Jenkins project Products: Jenkins P4 Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2327
CVE ID: CVE-2021-21656 State: PUBLISHED Published: 2021-05-11T14:15:25 Last Updated: 2024-08-03T18:23:28.503Z Vendors: Jenkins project Products: Jenkins Xcode integration Plugin Description: Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2335
CVE ID: CVE-2021-21657 State: PUBLISHED Published: 2021-05-25T14:10:14 Last Updated: 2024-08-03T18:23:27.525Z Vendors: Jenkins project Products: Jenkins Filesystem Trigger Plugin Description: Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2339 - http://www.openwall.com/lists/oss-security/2021/05/25/3
CVE ID: CVE-2021-21658 State: PUBLISHED Published: 2021-05-25T14:10:14 Last Updated: 2024-08-03T18:23:27.475Z Vendors: Jenkins project Products: Jenkins Nuget Plugin Description: Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2340 - http://www.openwall.com/lists/oss-security/2021/05/25/3
CVE ID: CVE-2021-21659 State: PUBLISHED Published: 2021-05-25T14:10:15 Last Updated: 2024-08-03T18:23:27.383Z Vendors: Jenkins project Products: Jenkins URLTrigger Plugin Description: Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2341 - http://www.openwall.com/lists/oss-security/2021/05/25/3
CVE ID: CVE-2021-21660 State: PUBLISHED Published: 2021-05-25T14:10:16 Last Updated: 2024-08-03T18:23:27.399Z Vendors: Jenkins project Products: Jenkins Markdown Formatter Plugin Description: Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2198 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-21660 - http://www.openwall.com/l
5/#SECURITY-2198 - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-21660 - http://www.openwall.com/lists/oss-security/2021/05/25/3
CVE ID: CVE-2021-21661 State: PUBLISHED Published: 2021-06-10T14:25:19 Last Updated: 2024-08-03T18:23:27.518Z Vendors: Jenkins project Products: Jenkins Kubernetes CLI Plugin Description: Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-2370 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21662 State: PUBLISHED Published: 2021-06-10T14:25:20 Last Updated: 2024-08-03T18:23:27.500Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1981 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21663 State: PUBLISHED Published: 2021-06-10T14:25:21 Last Updated: 2024-08-03T18:23:27.490Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21664 State: PUBLISHED Published: 2021-06-10T14:25:21 Last Updated: 2024-08-03T18:23:27.397Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21665 State: PUBLISHED Published: 2021-06-10T14:25:22 Last Updated: 2024-08-03T18:23:28.440Z Vendors: Jenkins project Products: Jenkins XebiaLabs XL Deploy Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-1982 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21666 State: PUBLISHED Published: 2021-06-10T14:25:22 Last Updated: 2024-08-03T18:23:27.488Z Vendors: Jenkins project Products: Jenkins Kiuwan Plugin Description: Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-10/#SECURITY-2367 - http://www.openwall.com/lists/oss-security/2021/06/10/14
CVE ID: CVE-2021-21667 State: PUBLISHED Published: 2021-06-16T13:40:11 Last Updated: 2024-08-03T18:23:27.512Z Vendors: Jenkins project Products: Jenkins Scriptler Plugin Description: Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-16/#SECURITY-2224 - http://www.openwall.com/lists/oss-security/2021/06/16/3
CVE ID: CVE-2021-21668 State: PUBLISHED Published: 2021-06-16T13:40:12 Last Updated: 2024-08-03T18:23:27.481Z Vendors: Jenkins project Products: Jenkins Scriptler Plugin Description: Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-16/#SECURITY-2390 - http://www.openwall.com/lists/oss-security/2021/06/16/3
CVE ID: CVE-2021-21669 State: PUBLISHED Published: 2021-06-18T09:25:10 Last Updated: 2024-08-03T18:23:27.500Z Vendors: Jenkins project Products: Jenkins Generic Webhook Trigger Plugin Description: Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-18/#SECURITY-2330 - http://www.openwall.com/lists/oss-security/2021/06/18/1
CVE ID: CVE-2021-21670 State: PUBLISHED Published: 2021-06-30T16:45:16 Last Updated: 2024-08-03T18:23:27.509Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2278 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21671 State: PUBLISHED Published: 2021-06-30T16:45:17 Last Updated: 2024-08-03T18:23:27.410Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2371 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21672 State: PUBLISHED Published: 2021-06-30T16:45:19 Last Updated: 2024-08-03T18:23:27.399Z Vendors: Jenkins project Products: Jenkins Selenium HTML report Plugin Description: Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2329 - http://www.openwall.com/lists/oss-security/2021/06/30/1 - http://www.openwall.com/lists/oss-security/2022/04/14/2
CVE ID: CVE-2021-21673 State: PUBLISHED Published: 2021-06-30T16:45:20 Last Updated: 2024-08-03T18:23:29.200Z Vendors: Jenkins project Products: Jenkins CAS Plugin Description: Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2387 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21674 State: PUBLISHED Published: 2021-06-30T16:45:22 Last Updated: 2024-08-03T18:23:28.263Z Vendors: Jenkins project Products: Jenkins requests-plugin Plugin Description: A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-1995 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21675 State: PUBLISHED Published: 2021-06-30T16:45:24 Last Updated: 2024-08-03T18:23:27.476Z Vendors: Jenkins project Products: Jenkins requests-plugin Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2136%20%281%29 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21676 State: PUBLISHED Published: 2021-06-30T16:45:25 Last Updated: 2024-08-03T18:23:28.305Z Vendors: Jenkins project Products: Jenkins requests-plugin Plugin Description: Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to send test emails to an attacker-specified email address. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-2136%20%282%29 - http://www.openwall.com/lists/oss-security/2021/06/30/1
CVE ID: CVE-2021-21677 State: PUBLISHED Published: 2021-08-31T13:50:13 Last Updated: 2024-08-03T18:23:27.501Z Vendors: Jenkins project Products: Jenkins Code Coverage API Plugin Description: Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk, resulting in a remote code execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2376 - http://www.openwall.com/lists/oss-security/2021/08/31/1
CVE ID: CVE-2021-21678 State: PUBLISHED Published: 2021-08-31T13:50:15 Last Updated: 2024-08-03T18:23:28.790Z Vendors: Jenkins project Products: Jenkins SAML Plugin Description: Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2469 - http://www.openwall.com/lists/oss-security/2021/08/31/1
CVE ID: CVE-2021-21679 State: PUBLISHED Published: 2021-08-31T13:50:16 Last Updated: 2024-08-03T18:23:29.177Z Vendors: Jenkins project Products: Jenkins Azure AD Plugin Description: Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470 - http://www.openwall.com/lists/oss-security/2021/08/31/1
CVE ID: CVE-2021-21680 State: PUBLISHED Published: 2021-08-31T13:50:18 Last Updated: 2024-08-03T18:23:28.576Z Vendors: Jenkins project Products: Jenkins Nested View Plugin Description: Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2411 - http://www.openwall.com/lists/oss-security/2021/08/31/1
CVE ID: CVE-2021-21681 State: PUBLISHED Published: 2021-08-31T13:50:20 Last Updated: 2024-08-03T18:23:29.264Z Vendors: Jenkins project Products: Jenkins Nomad Plugin Description: Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2396 - http://www.openwall.com/lists/oss-security/2021/08/31/1
CVE ID: CVE-2021-21682 State: PUBLISHED Published: 2021-10-06T22:10:11 Last Updated: 2024-08-03T18:23:28.256Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2424 - http://www.openwall.com/lists/oss-security/2021/10/06/1
CVE ID: CVE-2021-21683 State: PUBLISHED Published: 2021-10-06T22:10:13 Last Updated: 2024-08-03T18:23:28.623Z Vendors: Jenkins project Products: Jenkins Description: The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2481 - http://www.openwall.com/lists/oss-security/2021/10/06/1
CVE ID: CVE-2021-21684 State: PUBLISHED Published: 2021-10-06T22:10:14 Last Updated: 2024-08-03T18:23:28.621Z Vendors: Jenkins project Products: Jenkins Git Plugin Description: Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499 - http://www.openwall.com/lists/oss-security/2021/10/06/1
CVE ID: CVE-2021-21685 State: PUBLISHED Published: 2021-11-04T16:30:24 Last Updated: 2024-08-03T18:23:29.423Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455 - http://www.openwall.com/lists/oss-security/2021/11/04/3
CVE ID: CVE-2021-21686 State: PUBLISHED Published: 2021-11-04T16:30:25 Last Updated: 2024-08-03T18:23:29.289Z Vendors: Jenkins project Products: Jenkins Description: File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
CVE ID: CVE-2021-21687 State: PUBLISHED Published: 2021-11-04T16:30:27 Last Updated: 2024-08-03T18:23:28.304Z Vendors: Jenkins project Products: Jenkins Description: Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
CVE ID: CVE-2021-21688 State: PUBLISHED Published: 2021-11-04T16:30:28 Last Updated: 2024-08-03T18:23:28.294Z Vendors: Jenkins project Products: Jenkins Description: The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo). Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
CVE ID: CVE-2021-21689 State: PUBLISHED Published: 2021-11-04T16:30:30 Last Updated: 2024-08-03T18:23:27.504Z Vendors: Jenkins project Products: Jenkins Description: FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
CVE ID: CVE-2021-21690 State: PUBLISHED Published: 2021-11-04T16:30:32 Last Updated: 2024-08-03T18:23:27.487Z Vendors: Jenkins project Products: Jenkins Description: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455