CVE-2021-21649

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 59.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Dashboard View PluginJenkins Dashboard View
Timeline
PublishedMay 11
Latest updateJun 16

Description

Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_dashboard_view_pluginunspecified — 2.15

🔴Vulnerability Details

3
OSV
Cross-site Scripting in Jenkins Dashboard View Plugin↗2021-06-16
▶
GHSA
Cross-site Scripting in Jenkins Dashboard View Plugin↗2021-06-16
▶
CVEList
CVE-2021-21649: Jenkins Dashboard View Plugin 2↗2021-05-11
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2021-05-11↗2021-05-11
▶
CVE-2021-21649 (MEDIUM CVSS 5.4) | Jenkins Dashboard View Plugin 2.15 | cvebase.io