Name: CVE-2021-21602: Improper Link Resolution Before File Access
Creator: Rapid7
Published: 2021-01-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-21602, CWE-59, CVSS 6.5, EPSS 0.02253

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

CVSS Details

CVSS 3.1 Base Score: 6.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade jenkins	Aug 22, 2024	Jan 13, 2021
Arch Linux	—	Upgrade to the latest version of Arch Linux	Jul 11, 2025	Jan 13, 2021
Jenkins 2021 01 13	—	Upgrade Jenkins to version 2.275Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to version 2.263.2Upgrade Jenkins LTS to the latest version	Dec 2, 2021	Jan 13, 2021
Redhat Openshift	—	Upgrade rteval-loadsUpgrade openstack-ironicUpgrade python-oslo-dbUpgrade butaneUpgrade python-ironic-prometheus-exporterUpgrade openshift-kuryrUpgrade python-stevedoreUpgrade python-hardwareUpgrade ostreeUpgrade python-pyrsistentUpgrade openstack-ironic-python-agentUpgrade openstack-ironic-inspectorUpgrade python-openshiftUpgrade kata-containersUpgrade python-oslo-serviceUpgrade cri-toolsUpgrade python-oslo-policyUpgrade ironic-images-ipa-ppc64leUpgrade python-oslo-i18nUpgrade python-ironic-libUpgrade ironic-imagesUpgrade openshift-ansibleUpgrade python-oslo-upgradecheckUpgrade python-oslo-serializationUpgrade python-eventletUpgrade python-oslo-concurrencyUpgrade cri-oUpgrade openvswitch2.15Upgrade python-kubernetesUpgrade redhat-release-coreosUpgrade python-oslo-utilsUpgrade runcUpgrade python-oslo-logUpgrade ignitionUpgrade python-sushy-oem-idracUpgrade python-toozUpgrade ovn2.13Upgrade console-login-helper-messagesUpgrade toolboxUpgrade openshiftUpgrade python-sushyUpgrade podmanUpgrade python-oslo-configUpgrade python-jsonschemaUpgrade python-debtcollectorUpgrade haproxyUpgrade python-keystoneauth1Upgrade atomic-openshift-service-idlerUpgrade coreos-installerUpgrade machine-config-daemonUpgrade python-openstacksdkUpgrade conmonUpgrade ironic-images-ipa-x86_64Upgrade jenkins-2-pluginsUpgrade python-oslo-contextUpgrade jenkinsUpgrade rust-afterburnUpgrade openshift-clients	Feb 19, 2021	Jan 13, 2021

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence