~ / search / GHSA-wv63-gwr9-5c55

GHSA-wv63-gwr9-5c55

Stored XSS vulnerability in Jenkins button labels

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21608

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.main:jenkins-core < 2.275 2.275
Maven org.jenkins-ci.main:jenkins-core >= 2.263.2, < 2.275 2.275

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI. This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the Pipeline `input` step. Jenkins 2.275, LTS 2.263.2 escapes button labels in the Jenkins UI.

References

External links from the advisory. They lead to third-party sites.