1. Home
  2. CVE Database
  3. CVE-2021-21609
MEDIUM · 5.3

CVE-2021-21609

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URL...

Vulnerability Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
JenkinsJenkins<= 2.263.1

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2021-21609?

CVE-2021-21609 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URL...

How severe is CVE-2021-21609?

CVE-2021-21609 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21609?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Jenkins.