CVE-2021-21694

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.318 and earlier Jenkins LTS versions 2.303.2 and earlier

Description The issue is related to the absence of an authorization procedure in the Jenkins automation server. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace functions do not check any permissions in the affected Jenkins versions.

Recommendations For Jenkins versions 2.318 and earlier, consider disabling the FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace functions until a patch is available. For Jenkins LTS versions 2.303.2 and earlier, consider disabling the FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace functions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.