CVE-2021-21618: XSS
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Other sources
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21618?
CVE-2021-21618 has been classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS).
How do I fix CVE-2021-21618?
To fix CVE-2021-21618, upgrade to Jenkins Repository Connector Plugin version 2.0.3 or later.
Who is affected by CVE-2021-21618?
CVE-2021-21618 affects all users of Jenkins Repository Connector Plugin versions 2.0.2 and earlier.
What type of vulnerability is CVE-2021-21618?
CVE-2021-21618 is a stored cross-site scripting (XSS) vulnerability.
What permissions are required to exploit CVE-2021-21618?
An attacker needs Item/Configure permissions to exploit the vulnerability CVE-2021-21618.