CVE-2021-21615 - Vulnerability Details

Vendors	Products
Jenkins	Jenkins
Redhat	Openshift

Package	CPE	Advisory	Released Date
Red Hat OpenShift Container Platform 4.5
conmon-2:2.0.21-1.rhaos4.5.el7	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
jenkins-0:2.263.3.1612434332-1.el7	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
machine-config-daemon-0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
openshift-0:4.5.0-202102050524.p0.git.0.9229406.el7	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
openshift-ansible-0:4.5.0-202102031005.p0.git.0.c6839a2.el7	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
openshift-clients-0:4.5.0-202102051529.p0.git.3612.61b096a.el8	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
runc-0:1.0.0-72.rhaos4.5.giteadfc6b.el8	cpe:/a:redhat:openshift:4.5::el7	RHSA-2021:0429	2021-03-03T00:00:00Z
Red Hat OpenShift Container Platform 4.6
jenkins-0:2.263.3.1612434510-1.el8	cpe:/a:redhat:openshift:4.6::el8	RHSA-2021:0423	2021-02-17T00:00:00Z

Link	Providers
http://www.openwall.com/lists/oss-security/2021/01/26/2
https://nvd.nist.gov/vuln/detail/CVE-2021-21615
https://www.cve.org/CVERecord?id=CVE-2021-21615
https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Jenkins", "vendor": "Jenkins project", "versions": [{"status": "affected", "version": "2.275"}, {"status": "affected", "version": "LTS 2.263.2"}]}], "descriptions": [{"lang": "en", "value": "Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T15:50:34.887Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"}, {"name": "[oss-security] 20210126 Vulnerability in Jenkins", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2021-21615", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins", "version": {"version_data": [{"version_affected": "=", "version_value": "2.275"}, {"version_affected": "=", "version_value": "LTS 2.263.2"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}]}, "references": {"reference_data": [{"name": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197", "refsource": "CONFIRM", "url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"}, {"name": "[oss-security] 20210126 Vulnerability in Jenkins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:16:23.697Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"}, {"name": "[oss-security] 20210126 Vulnerability in Jenkins", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"}]}]}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2021-21615", "datePublished": "2021-01-26T10:55:13", "dateReserved": "2021-01-04T00:00:00", "dateUpdated": "2024-08-03T18:16:23.697Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Jenkins (string)

vendor : Jenkins project (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.275 (string)

}

1 : { »

status : affected (string)

version : LTS 2.263.2 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition. (string)

}

]

providerMetadata : { »

orgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

shortName : jenkins (string)

dateUpdated : 2023-10-24T15:50:34.887Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

}

1 : { »

name : [oss-security] 20210126 Vulnerability in Jenkins (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2021/01/26/2 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : jenkinsci-cert@googlegroups.com (string)

ID : CVE-2021-21615 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Jenkins (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 2.275 (string)

}

1 : { »

version_affected : = (string)

version_value : LTS 2.263.2 (string)

}

]

}

]

}

vendor_name : Jenkins project (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

refsource : CONFIRM (string)

url : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

}

1 : { »

name : [oss-security] 20210126 Vulnerability in Jenkins (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2021/01/26/2 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T18:16:23.697Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

}

1 : { »

name : [oss-security] 20210126 Vulnerability in Jenkins (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2021/01/26/2 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 39769cd5-e6e2-4dc8-927e-97b3aa056f5b (string)

assignerShortName : jenkins (string)

cveId : CVE-2021-21615 (string)

datePublished : 2021-01-26T10:55:13 (string)

dateReserved : 2021-01-04T00:00:00 (string)

dateUpdated : 2024-08-03T18:16:23.697Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*", "matchCriteriaId": "4578E2F0-6569-4454-8B83-2474D19D4B3D", "versionEndExcluding": "2.263.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*", "matchCriteriaId": "41CEBC65-D8D3-433F-A6FE-97102FB5E328", "versionEndExcluding": "2.276", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition."}, {"lang": "es", "value": "Jenkins versiones 2.275 y LTS 2.263.2, permiten leer archivos arbitrarios usando el explorador de archivos para espacios de trabajo y artefactos archivados debido a una condici\u00f3n de carrera de tipo time-of-check a time-of-use (TOCTOU)"}], "id": "CVE-2021-21615", "lastModified": "2024-11-21T05:48:42.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-01-26T18:16:18.693", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/01/26/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* (string)

matchCriteriaId : 4578E2F0-6569-4454-8B83-2474D19D4B3D (string)

versionEndExcluding : 2.263.3 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 41CEBC65-D8D3-433F-A6FE-97102FB5E328 (string)

versionEndExcluding : 2.276 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition. (string)

}

1 : { »

lang : es (string)

value : Jenkins versiones 2.275 y LTS 2.263.2, permiten leer archivos arbitrarios usando el explorador de archivos para espacios de trabajo y artefactos archivados debido a una condición de carrera de tipo time-of-check a time-of-use (TOCTOU) (string)

}

]

id : CVE-2021-21615 (string)

lastModified : 2024-11-21T05:48:42.190 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:M/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 6.8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-01-26T18:16:18.693 (string)

references : [ »

0 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2021/01/26/2 (string)

}

1 : { »

source : jenkinsci-cert@googlegroups.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2021/01/26/2 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

}

]

sourceIdentifier : jenkinsci-cert@googlegroups.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-367 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "conmon-2:2.0.21-1.rhaos4.5.el7", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "jenkins-0:2.263.3.1612434332-1.el7", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "machine-config-daemon-0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "openshift-0:4.5.0-202102050524.p0.git.0.9229406.el7", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "openshift-ansible-0:4.5.0-202102031005.p0.git.0.c6839a2.el7", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "openshift-clients-0:4.5.0-202102051529.p0.git.3612.61b096a.el8", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0429", "cpe": "cpe:/a:redhat:openshift:4.5::el7", "package": "runc-0:1.0.0-72.rhaos4.5.giteadfc6b.el8", "product_name": "Red Hat OpenShift Container Platform 4.5", "release_date": "2021-03-03T00:00:00Z"}, {"advisory": "RHSA-2021:0423", "cpe": "cpe:/a:redhat:openshift:4.6::el8", "package": "jenkins-0:2.263.3.1612434510-1.el8", "product_name": "Red Hat OpenShift Container Platform 4.6", "release_date": "2021-02-17T00:00:00Z"}], "bugzilla": {"description": "jenkins: Filesystem traversal by privileged users", "id": "1921322", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921322"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-22", "details": ["Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition."], "name": "CVE-2021-21615", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "jenkins", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "jenkins", "product_name": "Red Hat OpenShift Container Platform 3.11"}], "public_date": "2021-01-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-21615\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-21615\nhttps://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : conmon-2:2.0.21-1.rhaos4.5.el7 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : jenkins-0:2.263.3.1612434332-1.el7 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : machine-config-daemon-0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : openshift-0:4.5.0-202102050524.p0.git.0.9229406.el7 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : openshift-ansible-0:4.5.0-202102031005.p0.git.0.c6839a2.el7 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : openshift-clients-0:4.5.0-202102051529.p0.git.3612.61b096a.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2021:0429 (string)

cpe : cpe:/a:redhat:openshift:4.5::el7 (string)

package : runc-0:1.0.0-72.rhaos4.5.giteadfc6b.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.5 (string)

release_date : 2021-03-03T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2021:0423 (string)

cpe : cpe:/a:redhat:openshift:4.6::el8 (string)

package : jenkins-0:2.263.3.1612434510-1.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.6 (string)

release_date : 2021-02-17T00:00:00Z (string)

}

]

bugzilla : { »

description : jenkins: Filesystem traversal by privileged users (string)

id : 1921322 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=1921322 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 5.3 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

status : verified (string)

}

cwe : CWE-22 (string)

details : [ »

0 : Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition. (string)

]

name : CVE-2021-21615 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:jboss_fuse:7 (string)

fix_state : Not affected (string)

package_name : jenkins (string)

product_name : Red Hat Fuse 7 (string)

}

1 : { »

cpe : cpe:/a:redhat:openshift:3.11 (string)

fix_state : Will not fix (string)

package_name : jenkins (string)

product_name : Red Hat OpenShift Container Platform 3.11 (string)

}

]

public_date : 2021-01-26T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2021-21615 https://nvd.nist.gov/vuln/detail/CVE-2021-21615 https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object