CVE-2021-21697 log

Severity High
Remote Yes
Type Arbitrary filesystem access
Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins before 2.319 include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata).

Jenkins 2.319 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.
Group Package Affected Fixed Severity Status Ticket
AVG-2526 jenkins 2.318-1 2.319-1 Critical Fixed
Date Advisory Group Package Severity Type
05 Nov 2021 ASA-202111-1 AVG-2526 jenkins Critical multiple issues