CVE-2021-21682

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replacing the configuration and data of other entities on Windows.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	>= unspecified, <= 2.314; >= unspecified, <= LTS 2.303.1

References

http://www.openwall.com/lists/oss-security/2021/10/06/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2424Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/10/06/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2424Vendor Advisory

Timeline

Published: Oct 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-216836.5The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting i CVE-2021-216846.1Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them CVE-2021-216859.1Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs CVE-2021-216868.1File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize pa CVE-2021-216879.1Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a sym CVE-2021-216887.5The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject a CVE-2021-216899.1FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and e CVE-2021-21694.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.33 an CVE-2021-216909.8Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and CVE-2021-216919.8Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.CVE-2021-216929.8FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller CVE-2021-216939.8When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318