Description

FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.

Remediation

References

CVE-2021-21692

Related Vulnerabilities

WordPress Plugin Subscriptions & Memberships for PayPal Cross-Site Scripting (1.1.2)

Oracle JRE CVE-2013-2423 Vulnerability (CVE-2013-2423)

WordPress Plugin User Registration-Custom Registration Form, Login Form, and User Profile Privilege Escalation (3.1.5)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-3274)

Zope Web Application Server Other Vulnerability (CVE-2007-0240)

Severity

Critical

Classification

CVE-2021-21692 CWE-863

Tags

Missing Update Known Vulnerabilities