CVE-2021-21604

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.

Published: Jan 13, 2021
Updated: Oct 26, 2023
CVE: CVE-2021-21604
GHSA: GHSA-qv6f-rcv6-6q3x
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6
AV:N/AC:M/Au:S/C:P/I:P/A:P

CWEs:

CWE-502

OWASP TOP 10:

A8 - Insecure Deserialization

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.274.x
jenkins / jenkins	-	2.263.1.x
org.jenkins-ci.main / jenkins-core	-	2.263.2
org.jenkins-ci.main / jenkins-core	2.264	2.275

https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1923

Vulnerability Database

289,599

CVE-2021-21604