1. Home
  2. CVE Database
  3. CVE-2021-21686
HIGH · 8.1

CVE-2021-21686

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside...

Vulnerability Description

File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
JenkinsJenkins< 2.303.3

Related Weaknesses (CWE)

CWE-59

References

FAQ

What is CVE-2021-21686?

CVE-2021-21686 is a vulnerability with a CVSS score of 8.1 (HIGH). File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside...

How severe is CVE-2021-21686?

CVE-2021-21686 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-21686?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Jenkins.