Stored XSS Vulnerability in Jenkins Repository Connector Plugin

CVE-2021-21618

What is CVE-2021-21618?

The Jenkins Repository Connector Plugin prior to version 2.0.2 is prone to a stored cross-site scripting (XSS) vulnerability. This vulnerability arises because the plugin does not properly escape parameter names and descriptions that are stored for past builds. As a result, an attacker with 'Item/Configure' permissions can exploit this vulnerability to inject malicious scripts, potentially leading to unauthorized actions and data theft within the Jenkins environment. For more information, visit the Jenkins security advisory.

References