PT-2021-14654 · Jenkins · Jenkins

Jesse Glick + 1 · Published 2021-01-13 · Updated 2024-03-06 · CVE-2021-21611

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability, which is exploitable by attackers able to specify display names or IDs of item types shown on the New Item page. This occurs because display names and IDs of item types are not properly escaped. As of the publication of this advisory, the Jenkins security team is not aware of any plugins published via the Jenkins project update center that allow doing this.

Recommendations For Jenkins versions 2.274 and earlier, update to version 2.275 or later. For LTS versions 2.263.1 and earlier, update to version 2.263.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JENKINS-2021-21611

CVE-2021-21611

GHSA-MJ7Q-CMF3-MG7H

RHSA-2021:0423

RHSA-2021:0429

RHSA-2021:0637

Affected Products

Jenkins

References · 10

• https://osv.dev/vulnerability/GHSA-mj7q-cmf3-mg7h · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jenkins-2021-21611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21611 · Security Note
• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2171 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21611 · Vendor Advisory
• https://github.com/jenkinsci/jenkins · Note
• https://github.com/jenkinsci/jenkins/commit/8c451b08886561a914ef0c30cbb9d40ea33a9bbe · Note
• https://t.me/cvenotify/8481 · Telegram Post
• https://t.me/cibsecurity/22086 · Telegram Post
• https://t.me/cvenotify/60422 · Telegram Post