CVE-2021-21610
published 2021-01-13CVE-2021-21610: Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.19%
63.9th percentile
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | anything_goes_formatter_plugin | — | — |
| jenkins | bumblebee_hp_alm_plugin | — | — |
| jenkins | jenkins | <= 2.263.1 | — |
| jenkins | jenkins | <= 2.274 | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| jenkins | tics_plugin | — | — |
| jenkins_project | jenkins | unspecified – 2.274 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Reflected XSS vulnerability in Jenkins markup formatter preview
ghsa·2022-05-24
CVE-2021-21610 [MEDIUM] CWE-79 Reflected XSS vulnerability in Jenkins markup formatter preview
Reflected XSS vulnerability in Jenkins markup formatter preview
Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).
Jenkins 2.275, LTS 2.263.2 requires that previe
OSV
Reflected XSS vulnerability in Jenkins markup formatter preview
osv·2022-05-24
CVE-2021-21610 [MEDIUM] Reflected XSS vulnerability in Jenkins markup formatter preview
Reflected XSS vulnerability in Jenkins markup formatter preview
Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).
Jenkins 2.275, LTS 2.263.2 requires that previe
Red Hat
jenkins: Reflected XSS vulnerability in markup formatter preview
vendor_redhat·2021-01-13·CVSS 6.1
CVE-2021-21610 [MEDIUM] CWE-79 jenkins: Reflected XSS vulnerability in markup formatter preview
jenkins: Reflected XSS vulnerability in markup formatter preview
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.
A flaw was found in jenkins. A cross-site scripting (XSS) vulnerability is possible due to the lack of restrictions in URL rendering in the formatted previews of markup passed as a query parameter if the configured markup formatter does not prohibit unsafe elements in the markup. The highest threat from this vulnerability is to data confidentiality and integrity.
Package: jenkins (Red Hat Fuse 7) - Not
Jenkins
Jenkins Security Advisory 2021-01-13
vendor_jenkins·2021-01-13·CVSS 5.4
CVE-2018-1000862 [MEDIUM] Jenkins Security Advisory 2021-01-13
Title: Jenkins Security Advisory 2021-01-13
Jenkins Security Advisory 2021-01-13
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Bumblebee HP ALM
Plugin
TICS
Plugin
tracetronic ecu.test
Plugin
Descriptions
XSS vulnerability in notification bar
SECURITY-1889
/
CVE-2021-21603
Severity (CV
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-13
Published