Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value.

This allows attackers with View/Create permission to create views with invalid or already-used names.

Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation and view creation.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 0 (fixed in 2.277.2)

Maven org.jenkins-ci.main:jenkins-core

Affected versions: 2.278 (fixed in 2.287)

Related CVEs

CVE-2021-21640

Key Information

GHSA ID

GHSA-w2hv-rcqr-2h7r

Published

May 24, 2022 5:46 PM

Last Modified

December 13, 2022 4:47 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:jenkins-core

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.