CVE-2021-21649: XSS
Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Other sources
Jenkins Dashboard View Plugin prior to 2.16 and 2.12.1 does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
As part of this fix, the property for image URLs was changed from url to imageUrl. Existing Configuration as Code configurations are still supported, but exports will emit the new property.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for Jenkins Dashboard View Plugin?
The vulnerability ID for Jenkins Dashboard View Plugin is CVE-2021-21649.
What is the severity of CVE-2021-21649?
The severity of CVE-2021-21649 is medium.
How does CVE-2021-21649 affect Jenkins Dashboard View Plugin?
CVE-2021-21649 affects Jenkins Dashboard View Plugin by allowing hackers with View/Configure permission to exploit a stored cross-site scripting (XSS) vulnerability.
What is the affected version of Jenkins Dashboard View Plugin?
Jenkins Dashboard View Plugin version 2.15 and earlier are affected by CVE-2021-21649.
How can I fix CVE-2021-21649 in Jenkins Dashboard View Plugin?
To fix CVE-2021-21649 in Jenkins Dashboard View Plugin, it is recommended to update to a version higher than 2.15.