Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tajdxLWNtZjMtbWc3aM4AAnOV

Stored XSS vulnerability in Jenkins on new item page

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

As of the publication of this advisory, the Jenkins security team is not aware of any plugins published via the Jenkins project update center that allow doing this.
Jenkins 2.275, LTS 2.263.2 escapes display names and IDs of item types shown on the New Item page.

Permalink: https://github.com/advisories/GHSA-mj7q-cmf3-mg7h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tajdxLWNtZjMtbWc3aM4AAnOV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-mj7q-cmf3-mg7h, CVE-2021-21611
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-21611
• https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171
• https://github.com/jenkinsci/jenkins/commit/8c451b08886561a914ef0c30cbb9d40ea33a9bbe
• https://github.com/advisories/GHSA-mj7q-cmf3-mg7h

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages