~ / search / GHSA-hg2w-3c4j-jjwm

GHSA-hg2w-3c4j-jjwm

Stored XSS vulnerability in Jenkins Repository Connector Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21618

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:repository-connector < 2.0.3 2.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Jenkins Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.

References

External links from the advisory. They lead to third-party sites.