Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

Remediation

References

CVE-2021-21611

Related Vulnerabilities

WordPress Plugin wp-mpdf Cross-Site Request Forgery (3.5.1)

WordPress Plugin PDF & Print Button Joliprint Multiple Cross-Site Scripting Vulnerabilities (1.3.0)

Moodle Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2021-36400)

WordPress Plugin Sell Downloads Unspecified Vulnerability (1.0.85)

CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-2117)

Severity

Medium

Classification

CVE-2021-21611 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities