CVE-2021-21609: 
Java vulnerability analysis and mitigation

CVE-2021-21609 is a security vulnerability discovered in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier, disclosed on January 13, 2021. The vulnerability stems from incorrect URL matching against a list of always-accessible paths, which could allow unauthorized access to certain plugin-provided URLs without requiring the default Overall/Read permission (Jenkins Advisory).

The vulnerability occurs because Jenkins maintains a static list of URLs that are always accessible without Overall/Read permission (such as the login form), but the system did not correctly compare requested URLs with that list. This implementation flaw allowed attackers to access plugin-provided URLs with specific prefixes like accessDenied, error, instance-identity, login, logout, oops, securityRealm, signup, and tcpSlaveAgentListener if no other permissions were required. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) (NVD).

The vulnerability could allow attackers without Overall/Read permission to access certain plugin-provided URLs that should be restricted. For example, if a plugin contributed a path like 'loginFoo/', URLs in that space would be accessible without the default Overall/Read permission check (Jenkins Advisory).

The vulnerability has been rated as having a Low severity impact. As of the advisory's publication, the Jenkins security team was not aware of any affected plugins or active exploits in the wild (Jenkins Advisory).

The vulnerability was fixed in Jenkins 2.275 and LTS 2.263.2, which corrected the comparison of requested URLs with the list of always accessible URLs to only allow access to specific listed URLs. For cases where this fix causes problems, administrators can configure additional paths to be accessible without Overall/Read permissions by using the Java system property 'jenkins.model.Jenkins.additionalReadablePaths', which accepts a comma-separated list of additional path prefixes (Jenkins Advisory).