GHSA-jwhm-9cjm-4493

Cross-site Scripting in Jenkins Dashboard View Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21649

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:dashboard-view	>= 2.13, < 2.16	2.16
Maven	org.jenkins-ci.plugins:dashboard-view	< 2.12.1	2.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Dashboard View Plugin prior to 2.16 and 2.12.1 does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. As part of this fix, the property for image URLs was changed from `url` to `imageUrl`. Existing [Configuration as Code](https://plugins.jenkins.io/configuration-as-code/) configurations are still supported, but exports will emit the new property.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21649 advisory
https://github.com/jenkinsci/dashboard-view-plugin/commit/586817b081d903e47cfdd05b96b8aae1d2c2700b web
https://github.com/CVEProject/cvelist/blob/2d78eb36f4d084db7fb35f1535d8d84fdcb7d859/2021/21xxx/CVE-2021-21649.json web
https://github.com/jenkinsci/dashboard-view-plugin package
https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2233 web