Cross-Site Scripting Vulnerability in TICS Plugin for Jenkins
CVE-2021-21613

6.1MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Tics Plugin
Vendor
CVE Published:
13 January 2021

What is CVE-2021-21613?

The TICS Plugin for Jenkins, in versions up to 2020.3.0.6, contains a cross-site scripting (XSS) vulnerability. This flaw arises from inadequate sanitization of responses from TICS services, allowing an attacker to inject malicious scripts through controlled TICS service responses. Exploitation could lead to unauthorized actions on behalf of users, potentially compromising sensitive data and system integrity. It is crucial for users to patch this vulnerability to enhance their security posture.

Affected Version(s)

Jenkins TICS Plugin <= 2020.3.0.6

References

https://www.jenkins.io/security/advisory/2021-01-13/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.