CVE-2021-21609

—

CVSS 3.1

5.3 medium

EPSS

1%p69

Published

Jan 13, 2021 (Jan 13, 2021)

Modified

Jun 17, 2026

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

Vendors: jenkins
Products: jenkins
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.