Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Jenkins allows unauthorized access to archived files

CVE-2021-21689 · published 5 years ago
Summary

An attacker with Jenkins access can read or modify archived files, potentially revealing sensitive information or disrupting builds. This affects Jenkins installations using FilePath#unzip and FilePath#untar without proper access controls. Update to a fixed version to prevent unauthorized access.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.319.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.303.3.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core >= 2.304, <= 2.318
< 2.303.3
Fix: upgrade to 2.319
– jenkins jenkins < 2.303.3
< 2.319
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
Original advisory text
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.1 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published4 Nov 2021
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-j3cq-h6vh-gx7f · GHSA
CVE-2021-21689 · NVD
Track software like this
Free during beta