CVE-2021-21611

CWE-79 — Cross-site Scripting (XSS)6 documents6 sources
Severity
5.4MEDIUM
EPSS
0.3%
top 45.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project JenkinsJenkins Jenkins
Timeline
PublishedJan 13
Latest updateMay 24

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶Mavenorg.jenkins-ci.main:jenkins-core2.264 — 2.275+1
▶NVDjenkins/jenkins2.263.1+1
▶CVEListV5jenkins_project/jenkinsunspecified — 2.274+1

🔴Vulnerability Details

3
OSV
Stored XSS vulnerability in Jenkins on new item page↗2022-05-24
▶
GHSA
Stored XSS vulnerability in Jenkins on new item page↗2022-05-24
▶
CVEList
CVE-2021-21611: Jenkins 2↗2021-01-13
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2021-01-13↗2021-01-13
▶
Red Hat
jenkins: Stored XSS vulnerability on new item page↗2021-01-13
▶
CVE-2021-21611 (MEDIUM CVSS 5.4) | Jenkins 2.274 and earlier | cvebase.io