Skip to content
Fencer Vulns
critical 9.1

CVE-2021-21685 in the critical feed json

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

published 2021-11-04 5 y ago modified 2026-09-08 2 mo ago also BIT-jenkins-2021-21685 , EUVD-2022-2538 , GHSA-58xm-mxjf-254g

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.

Patch / fix

  • maven org.jenkins-ci.main:jenkins-core 2.303.3, 2.319
  • bitnami jenkins 2.319.0
  • jenkins jenkins 2.303.3, 2.319
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2021:4827RHSA-2021:4799RHSA-2021:4801RHSA-2021:4829RHSA-2021:4833

  • jenkins Arch Linux 2.319-1

arch linux advisories AVG-2526

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21685 updated cvss 9.0

jenkins: FilePath#mkdirs does not check permission to create parent directories

  • Red Hat OpenShift Container Platform 3.11 jenkins 2.303.3.1637698110-1.el7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:4827
  • Red Hat OpenShift Container Platform 4.6 jenkins 2.303.3.1637597493-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:4799
  • Red Hat OpenShift Container Platform 4.7 jenkins 2.303.3.1637597018-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:4801
  • Red Hat OpenShift Container Platform 4.8 jenkins 2.303.3.1637596565-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:4829
  • Red Hat OpenShift Container Platform 4.9 jenkins 2.303.3.1637595827-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2021:4833
  • Red Hat OpenShift Container Platform 4.10 jenkins 2.319.2.1643288987-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0055
  • Red Hat Fuse 7 jenkins Red Hat OpenShift Container Platform 3.11 prometheus 3.11.569-1.g99aae51.el7, jenkins-2-plugins 3.11.1637699107-1.el7, openshift-kuryr 3.11.569-1.g0c4bf66.el7, openshift-kuryr-cni 3.11.569-1.g0c4bf66.el7, atomic-openshift 3.11.569-1.git.0.9dc951a.el7, openshift-ansible 3.11.569-1.git.0.9620ba1.el7, +35 more Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1637602169-1.el8, openshift 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, openshift 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, openshift-kuryr 4.6.0-202111041131.p0.git.7c5a4f7.assembly.stream.el8, openshift-hyperkube 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, openshift-hyperkube 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, +4 more Red Hat OpenShift Container Platform 4.7 cri-o 1.20.6-3.rhaos4.7.git4603183.el7, cri-o 1.20.6-3.rhaos4.7.git4603183.el8, jenkins-2-plugins 4.7.1637600997-1.el8, openshift 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, openshift 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el8, openshift-hyperkube 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, +1 more Red Hat OpenShift Container Platform 4.8 coreos-installer 0.9.0-8.rhaos4.8.el8, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el7, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el8, jenkins-2-plugins 4.8.1637599935-1.el8, coreos-installer-bootinfra 0.9.0-8.rhaos4.8.el8, python-sushy 3.7.4-0.20211119091058.2cc60dc.el8, +11 more Red Hat OpenShift Container Platform 4.9 cri-o 1.22.1-4.rhaos4.9.gite3dfe61.el7, cri-o 1.22.1-4.rhaos4.9.gite3dfe61.el8, jenkins-2-plugins 4.9.1637598812-1.el8, container-selinux 2.170.0-2.rhaos4.9.el8, python-sushy 3.12.1-0.20211122142104.806622c.el8, python3-sushy 3.12.1-0.20211122142104.806622c.el8, +10 more
    +1 more products
    Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +164 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.main:jenkins-core
<2.303.3
>=2.304, <2.319
2.303.3
2.319
bitnami jenkins
<2.319.0
2.319.0

Affected products

  • Jenkins project Jenkins

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.