PT-2021-14656 · Jenkins · Jenkins Metrics Plugin+1

Daniel Beck · Published 2021-01-13 · Updated 2023-11-03 · CVE-2021-21613

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins TICS Plugin versions 2020.3.0.6 and earlier

Description The issue results in a cross-site scripting (XSS) vulnerability, which is exploitable by attackers able to control TICS service response content. This occurs because the plugin does not escape TICS service responses.

Recommendations For Jenkins TICS Plugin versions 2020.3.0.6 and earlier, update to version 2020.3.0.7 or later, which escapes TICS service responses or strips HTML out as appropriate.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21613

GHSA-XMW5-45V9-PXQX

Affected Products

Jenkins

Jenkins Metrics Plugin

References · 9

• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21613 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmw5-45v9-pxqx · Vendor Advisory
• https://github.com/jenkinsci/tics-plugin · Note
• https://github.com/jenkinsci/tics-plugin/commit/a64493ccf81a241c5e51736721c4fe9a3e56622b · Note
• https://t.me/cibsecurity/22088 · Telegram Post
• https://t.me/cvenotify/8480 · Telegram Post
• https://t.me/cvenotify/60480 · Telegram Post