CVE-2021-21640: 
Java vulnerability analysis and mitigation

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier contained a view name validation bypass vulnerability identified as CVE-2021-21640. The vulnerability was discovered and disclosed on April 7, 2021, affecting the Jenkins core system. This medium severity issue impacted the view creation functionality in Jenkins (Jenkins Advisory).

The vulnerability occurred when creating a new view in Jenkins, where the name validation process was improperly implemented. When a form to create a view was submitted, the name was included twice in the submission. While one instance underwent validation, the other instance was used for creating the value, leading to a validation bypass. This implementation flaw allowed attackers with View/Create permission to create views with invalid or already-used names (Jenkins Advisory).

The vulnerability allowed attackers with View/Create permission to bypass the view name validation controls. This could result in the creation of views with names that would normally be rejected by the system, including invalid names or names that were already in use (Jenkins Advisory).

The vulnerability was fixed in Jenkins 2.287 and LTS 2.277.2. The fix ensures that the same submitted value is used for both validation and view creation, preventing the validation bypass. Users are advised to upgrade to these versions or later to address the vulnerability (Jenkins Advisory).