CVE-2021-21686

File path filters in the agent-to-controller security subsystem of Jenkins LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to f...

Original description

The description as published by the source.

File path filters in the agent-to-controller security subsystem of Jenkins LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami jenkins

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.319.0"}]}]

References

advisory jenkins.io
web nvd.nist.gov