Name: CVE-2021-21605: Improper Limitation of a Pathname to a Restricted Directory
Creator: Rapid7
Published: 2021-01-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-21605, CWE-22, CVSS 8, EPSS 0.02246

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global `config.xml` file.

CVSS Details

CVSS 3.1 Base Score: 8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade jenkins	Aug 22, 2024	Jan 13, 2021
Arch Linux	—	Upgrade to the latest version of Arch Linux	Jul 11, 2025	Jan 13, 2021
Jenkins 2021 01 13	—	Upgrade Jenkins LTS to version 2.263.2Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.275	Dec 2, 2021	Jan 13, 2021
Redhat Openshift	—	Upgrade ostreeUpgrade python-sushy-oem-idracUpgrade python-ironic-libUpgrade python-oslo-contextUpgrade python-kubernetesUpgrade openstack-ironic-inspectorUpgrade python-oslo-utilsUpgrade python-oslo-upgradecheckUpgrade openvswitch2.15Upgrade python-oslo-logUpgrade python-debtcollectorUpgrade haproxyUpgrade python-stevedoreUpgrade cri-toolsUpgrade machine-config-daemonUpgrade ironic-images-ipa-x86_64Upgrade python-oslo-serviceUpgrade python-ironic-prometheus-exporterUpgrade rteval-loadsUpgrade ignitionUpgrade runcUpgrade coreos-installerUpgrade cri-oUpgrade console-login-helper-messagesUpgrade rust-afterburnUpgrade python-openstacksdkUpgrade conmonUpgrade openstack-ironicUpgrade openshiftUpgrade python-jsonschemaUpgrade atomic-openshift-service-idlerUpgrade python-openshiftUpgrade toolboxUpgrade python-oslo-configUpgrade openshift-clientsUpgrade python-oslo-i18nUpgrade openshift-kuryrUpgrade podmanUpgrade kata-containersUpgrade python-eventletUpgrade python-toozUpgrade openstack-ironic-python-agentUpgrade openshift-ansibleUpgrade python-pyrsistentUpgrade ironic-images-ipa-ppc64leUpgrade redhat-release-coreosUpgrade python-keystoneauth1Upgrade butaneUpgrade python-oslo-concurrencyUpgrade ironic-imagesUpgrade python-oslo-serializationUpgrade python-sushyUpgrade python-hardwareUpgrade jenkins-2-pluginsUpgrade python-oslo-policyUpgrade jenkinsUpgrade python-oslo-dbUpgrade ovn2.13	Feb 19, 2021	Jan 13, 2021

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence