CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-21690
Critical (9.8) in jenkins jenkins. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.main:jenkins-core 2.303.3, 2.319.
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-97c3-w9cr-6qc2 | Maven | org.jenkins-ci.main:jenkins-core | <2.303.3 | 2.303.3 |
| GHSA-97c3-w9cr-6qc2 | Maven | org.jenkins-ci.main:jenkins-core | >=2.304 <2.319 | 2.319 |