CVE-2021-21698
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
7.5 HighFix available
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
2.14%Up 1.5 points since Nov 5, 2021
What each source reports
NVD Score used
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
- Record
CVE-2021-21698- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
- Record
CVE-2021-21698- Updated
- 2026-11-02
EUVDEUVD-2022-4893 No score
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
- Record
EUVD-2022-4893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q58j-fhj7-j6fg
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
Subversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.
- Record
GHSA-q58j-fhj7-j6fg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
- Record
CVE-2021-21698- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-q58j-fhj7-j6fg
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
Subversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.
- Record
GHSA-q58j-fhj7-j6fg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2021:4799
Red Hat Security Advisory: OpenShift Container Platform 4.6.51 packages and security update
- Record
RHSA-2021:4799- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4801
Red Hat Security Advisory: OpenShift Container Platform 4.7.38 security update
- Record
RHSA-2021:4801- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4827
Red Hat Security Advisory: OpenShift Container Platform 3.11.569 security update
- Record
RHSA-2021:4827- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4829
Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update
- Record
RHSA-2021:4829- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4833
Red Hat Security Advisory: OpenShift Container Platform 4.9.9 security update
- Record
RHSA-2021:4833- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0055
Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update
- Record
RHSA-2022:0055- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:subversionMaven |
through 2.15.0 | 2.15.1 |
org.jenkins-ci.plugins:subversionMaven |
before 2.15.1, plus listed versions 1.241.251.261.281.29 Show 45 moreShow less1.301.311.321.331.341.351.361.371.381.391.401.411.421.431.441.451.481.501.511.531.542.02.0-alpha-12.0-beta-12.12.102.10.12.10.22.10.32.10.42.10.52.10.62.11.02.11.12.12.02.12.12.12.22.13.02.13.12.13.22.14.02.14.12.14.22.14.32.14.4 |
2.15.1 |
jenkinsRed Hat:openshift:4.6::el8 From an advisory covering 14 CVEs |
before 0:2.303.3.1637597493-1.el8 | 0:2.303.3.1637597493-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.6::el8 From an advisory covering 14 CVEs |
before 0:4.6.1637602169-1.el8 | 0:4.6.1637602169-1.el8 |
jenkinsRed Hat:openshift:4.7::el8 From an advisory covering 14 CVEs |
before 0:2.303.3.1637597018-1.el8 | 0:2.303.3.1637597018-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.7::el8 From an advisory covering 14 CVEs |
before 0:4.7.1637600997-1.el8 | 0:4.7.1637600997-1.el8 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 14 CVEs |
before 0:2.303.3.1637698110-1.el7 | 0:2.303.3.1637698110-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 14 CVEs |
before 0:3.11.1637699107-1.el7 | 0:3.11.1637699107-1.el7 |
coreos-installerRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:0.9.0-8.rhaos4.8.el8 | 0:0.9.0-8.rhaos4.8.el8 |
jenkinsRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:2.303.3.1637596565-1.el8 | 0:2.303.3.1637596565-1.el8 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkins-2-pluginsRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:4.8.1637599935-1.el8 | 0:4.8.1637599935-1.el8 |
jenkinsRed Hat:openshift:4.9::el8 From an advisory covering 14 CVEs |
before 0:2.303.3.1637595827-1.el8 | 0:2.303.3.1637595827-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 14 CVEs |
before 0:4.9.1637598812-1.el8 | 0:4.9.1637598812-1.el8 |
jenkinsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:2.319.2.1643288987-1.el8 | 0:2.319.2.1643288987-1.el8 |
coreos-installerRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfraRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfra-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.1643404185-1.el8 | 0:4.10.1643404185-1.el8 |
cri-oRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
cri-o-debuginfoRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
cri-oRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
openshiftRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshift-clientsRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-clients-redistributableRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
openshift-clientsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-clients-redistributableRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21698 is a high vulnerability (CVSS 7.5) in Jenkins Subversion, published November 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in org.jenkins-ci.plugins:subversion 2.15.1.
References
jenkins.io/security/advisory/2021-11-04
openwall.com/lists/oss-security/2021/11/04/3
nvd.nist.gov/vuln/detail/CVE-2021-21698
github.com/jenkinsci/subversion-plugin/commit/7d1525edea6641a2febd3f7deeac55c0a89b0d7e
Show 130 moreShow less
access.redhat.com/errata/RHSA-2021:4799
bugzilla.redhat.com/show_bug.cgi?id=2020322
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4799.json
cve.org/CVERecord?id=CVE-2021-21685
groups.google.com/g/golang-announce/c/0fM21h43arc
kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster
This page doesn't list everything
Left out here: 28 versions. The JSON record has them.