PT-2021-14646 · Jenkins · Jenkins

Jesse Glick + 2 · Published 2021-01-13 · Updated 2024-03-06 · CVE-2021-21603

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.274 and earlier Jenkins LTS versions 2.263.1 and earlier

Description The issue results from the failure to escape notification bar response contents, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can influence the contents of the notification bar, typically shown after form submissions via the Apply button.

Recommendations For Jenkins versions 2.274 and earlier, update to version 2.275 or later. For Jenkins LTS versions 2.263.1 and earlier, update to version 2.263.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2021-21603

CVE-2021-21603

GHSA-98GQ-6HXG-52R6

RHSA-2021:0423

RHSA-2021:0429

RHSA-2021:0637

Affected Products

Jenkins

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-21603 · Security Note
• https://osv.dev/vulnerability/GHSA-98gq-6hxg-52r6 · Vendor Advisory
• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-1889 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21603 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2021-21603 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/f5d98421604e44f398e7de9d222b191a705608af · Note
• https://t.me/cvenotify/8487 · Telegram Post
• https://t.me/cibsecurity/22093 · Telegram Post
• https://t.me/cvenotify/60427 · Telegram Post