PT-2021-14709 · Jenkins · Jenkins Kiuwan Plugin+1

Published 2021-06-10 · Updated 2023-11-03 · CVE-2021-21666

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Kiuwan Plugin versions 1.6.0 and earlier

Description The issue is related to a reflected cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Kiuwan Plugin does not escape query parameters in an error message for a form validation endpoint. This allows an attacker to inject malicious scripts into the error message, potentially leading to the execution of unauthorized code on the user's browser. Only older releases of Jenkins are affected by this vulnerability, with Jenkins 2.275 and newer, and LTS 2.263.2 and newer including a protection that prevents this vulnerability from being exploitable.

Recommendations For Jenkins Kiuwan Plugin versions 1.6.0 and earlier, update to version 1.6.1 or newer, which escapes affected parts of the error message in the form validation endpoint. As a temporary workaround, consider restricting access to the form validation endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21666

GHSA-8H77-3XWR-HQHH

Affected Products

Jenkins

Jenkins Kiuwan Plugin

References · 8

• https://jenkins.io/security/advisory/2021-06-10/#SECURITY-2367 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8h77-3xwr-hqhh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21666 · Security Note
• https://github.com/jenkinsci/kiuwan-plugin · Note
• https://github.com/jenkinsci/kiuwan-plugin/commit/a5f6fdb1b8ad09d170547a4cc2b90c4829ef1f0a · Note
• https://t.me/cvenotify/16102 · Telegram Post
• http://openwall.com/lists/oss-security/2021/06/10/14 · Note