CVE-2021-21688

The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins LTS 2.303.2 and earlier does not reject any operations, allowing users...

Original description

The description as published by the source.

The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins LTS 2.303.2 and earlier does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, FilePath#copyRecursiveTo).

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami jenkins

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.319.0"}]}]

References

advisory jenkins.io
web nvd.nist.gov