Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA0NzktcndocC1yd2p4
Stored XSS vulnerability in Jenkins Scriptler Plugin
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Jenkins Scriptler Plugin 3.3 escapes parameter names shown in job configuration forms.
Permalink: https://github.com/advisories/GHSA-p479-rwhp-rwjxJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA0NzktcndocC1yd2p4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 4 months ago
CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-p479-rwhp-rwjx, CVE-2021-21667
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-21667
- https://www.jenkins.io/security/advisory/2021-06-16/#SECURITY-2224
- http://www.openwall.com/lists/oss-security/2021/06/16/3
- https://github.com/jenkinsci/scriptler-plugin/commit/ea9c4e6abdd15ee4731e76bb7130069af6dfed88
- https://github.com/advisories/GHSA-p479-rwhp-rwjx
Blast Radius: 1.0
Affected Packages
maven:org.jenkins-ci.plugins:scriptler
Affected Version Ranges: < 3.3Fixed in: 3.3