CVE-2021-21682: Improper handling of equivalent directory names on Windows in Jenkins
6.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.74395%
CWE
Published
5/24/2022
Updated
12/18/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core | maven | >= 2.304, <= 2.314 | 2.315 |
| org.jenkins-ci.main:jenkins-core | maven | <= 2.303.1 | 2.303.2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from Jenkins' filename validation logic allowing trailing dots in entity names. The commit diff shows the vulnerability was patched by adding a trailing dot check in Jenkins.checkGoodName(). In vulnerable versions, this function did not include the 'endsWith(".")' validation, making it the root cause. The function is directly responsible for validating entity names and its lack of trailing dot handling created the path equivalence vulnerability on Windows systems.