GHSA-p479-rwhp-rwjx

Stored XSS vulnerability in Jenkins Scriptler Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21667

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:scriptler	< 3.3	3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. Jenkins Scriptler Plugin 3.3 escapes parameter names shown in job configuration forms.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21667 advisory
https://github.com/jenkinsci/scriptler-plugin/commit/ea9c4e6abdd15ee4731e76bb7130069af6dfed88 web
https://github.com/jenkinsci/scriptler-plugin package
https://www.jenkins.io/security/advisory/2021-06-16/#SECURITY-2224 web
http://www.openwall.com/lists/oss-security/2021/06/16/3 web