GHSA-q58j-fhj7-j6fg

Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21698

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:subversion	< 2.15.1	2.15.1

Details

As written in the advisory (Markdown source, shown as plain text).

Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. Subversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21698 advisory
https://github.com/jenkinsci/subversion-plugin/commit/7d1525edea6641a2febd3f7deeac55c0a89b0d7e web
https://github.com/jenkinsci/subversion-plugin package
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506 web
http://www.openwall.com/lists/oss-security/2021/11/04/3 web