CVE-2021-21671: 
Java vulnerability analysis and mitigation

CVE-2021-21671 is a session fixation vulnerability discovered in Jenkins versions 2.299 and earlier, and LTS 2.289.1 and earlier. The vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1 and was disclosed on June 30, 2021. The issue stems from Jenkins not invalidating the existing session during the login process (Jenkins Advisory).

The vulnerability is rated as High severity and involves a session fixation flaw where the application fails to invalidate the previous session when a user logs in. This security weakness could be exploited through social engineering techniques to potentially gain administrator access to Jenkins (Jenkins Advisory).

The vulnerability allows attackers to use social engineering techniques to potentially gain administrator access to Jenkins systems. This could lead to complete compromise of the Jenkins instance and associated resources (Jenkins Advisory).

The vulnerability requires social engineering techniques to exploit, suggesting a moderate level of complexity in execution. No public exploits have been reported in the wild (Red Hat CVE).

The vulnerability has been fixed in Jenkins 2.300 and LTS 2.289.2, which now properly invalidates the existing session on login. For administrators experiencing issues with the fix, there is a configuration option to choose a different implementation by setting the Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode to 2, or disable the fix entirely by setting that system property to 0 (Jenkins Advisory).