CVE-2021-21618

Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Score

CVSS 3.1 5.4 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2021-02-24

Last modified

2024-08-03

Weaknesses

CWE-79

Affected products

• Repository Connector (Jenkins)
• Jenkins Repository Connector Plugin (Jenkins Project)

References

• https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2183