Skip to content
Fencer Vulns
high 7.5

CVE-2021-21698 json

Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files

published 2021-11-04 5 y ago modified 2026-06-17 4 mo ago also GHSA-q58j-fhj7-j6fg , EUVD-2022-4893

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.

Patch / fix

  • maven org.jenkins-ci.plugins:subversion 2.15.1
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2021:4827RHSA-2021:4799RHSA-2021:4801RHSA-2021:4829RHSA-2021:4833

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21698 updated cvss 7.5

jenkins-2-plugins/subversion: does not restrict the name of a file when looking up a subversion key

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1637699107-1.el7
    fixed: vendor fix RHSA-2021:4827
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1637602169-1.el8
    fixed: vendor fix RHSA-2021:4799
  • Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins 4.7.1637600997-1.el8
    fixed: vendor fix RHSA-2021:4801
  • Red Hat OpenShift Container Platform 4.8 jenkins-2-plugins 4.8.1637599935-1.el8
    fixed: vendor fix RHSA-2021:4829
  • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1637598812-1.el8
    fixed: vendor fix RHSA-2021:4833
  • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1643404185-1.el8
    fixed: vendor fix RHSA-2022:0055
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.303.3.1637698110-1.el7, prometheus 3.11.569-1.g99aae51.el7, openshift-kuryr 3.11.569-1.g0c4bf66.el7, openshift-kuryr-cni 3.11.569-1.g0c4bf66.el7, atomic-openshift 3.11.569-1.git.0.9dc951a.el7, openshift-ansible 3.11.569-1.git.0.9620ba1.el7, +35 more Red Hat OpenShift Container Platform 4.6 jenkins 2.303.3.1637597493-1.el8, openshift 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, openshift 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, openshift-kuryr 4.6.0-202111041131.p0.git.7c5a4f7.assembly.stream.el8, openshift-hyperkube 4.6.0-202111100230.p0.git.6063298.assembly.stream.el7, openshift-hyperkube 4.6.0-202111100230.p0.git.6063298.assembly.stream.el8, +4 more Red Hat OpenShift Container Platform 4.7 jenkins 2.303.3.1637597018-1.el8, cri-o 1.20.6-3.rhaos4.7.git4603183.el7, cri-o 1.20.6-3.rhaos4.7.git4603183.el8, openshift 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, openshift 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el8, openshift-hyperkube 4.7.0-202111192046.p0.gaa025a0.assembly.stream.el7, +1 more Red Hat OpenShift Container Platform 4.8 jenkins 2.303.3.1637596565-1.el8, coreos-installer 0.9.0-8.rhaos4.8.el8, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el7, cri-o 1.21.4-3.rhaos4.8.git84fa55d.el8, coreos-installer-bootinfra 0.9.0-8.rhaos4.8.el8, python-sushy 3.7.4-0.20211119091058.2cc60dc.el8, +11 more Red Hat OpenShift Container Platform 4.9 jenkins 2.303.3.1637595827-1.el8, cri-o 1.22.1-4.rhaos4.9.gite3dfe61.el7, cri-o 1.22.1-4.rhaos4.9.gite3dfe61.el8, container-selinux 2.170.0-2.rhaos4.9.el8, python-sushy 3.12.1-0.20211122142104.806622c.el8, python3-sushy 3.12.1-0.20211122142104.806622c.el8, +10 more Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +164 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:subversion
<2.15.1
2.15.1

Affected products

  • Jenkins project Jenkins Subversion Plugin

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.