#VU50020 Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins and Jenkins LTS


Published: 2021-01-26

Vulnerability identifier: #VU50020

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21615

CWE-ID: CWE-367

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jenkins
Server applications / Application servers
Jenkins LTS
Server applications / Application servers

Vendor: Jenkins

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to a race condition in the file browser for workspaces. A remote user with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, can create symbolic links that allow them to access files outside workspaces using the workspace browser.

Note, the vulnerability is caused by incorrect patch for #VU49527

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Jenkins: 2.0 - 2.275

Jenkins LTS: 2.7.1 - 2.263.2


External links
http://jenkins.io/security/advisory/2021-01-26/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability