GHSA-f9gf-2q87-5m44

Stored XSS vulnerability in Jenkins Scriptler Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21700

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:scriptler	< 3.4	3.4

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts. Jenkins Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21700 advisory
https://github.com/jenkinsci/scriptler-plugin/commit/7e4fa9b51f37714decca30a35dd81e41f72aec93 web
https://github.com/jenkinsci/scriptler-plugin package
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2406 web
http://www.openwall.com/lists/oss-security/2021/11/12/1 web