GHSA-wx66-pm7r-2q82

Stored XSS vulnerability in Jenkins Extra Columns Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21630

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:extra-columns	< 1.23	1.23

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build parameters column, or the attacker also needs View/Configure permission. Jenkins Extra Columns Plugin 1.23 escapes parameter values in the build parameters column.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-21630 advisory
https://github.com/jenkinsci/extra-columns-plugin/commit/929887caba35eb78a55fee31d08fb950200a92ef web
https://github.com/jenkinsci/extra-columns-plugin package
https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2222 web
http://www.openwall.com/lists/oss-security/2021/03/30/1 web