Stored Cross-Site Scripting in Jenkins Dashboard View Plugin
CVE-2021-21649
5.4MEDIUM
What is CVE-2021-21649?
The Jenkins Dashboard View Plugin, up to version 2.15, contains a vulnerability that allows attackers to exploit stored cross-site scripting (XSS) through unescaped URLs in Image Dashboard Portlets. This issue arises when users with View/Configure permissions are able to inject malicious JavaScript into the application, potentially compromising the integrity of the Jenkins environment and affecting user sessions.
Affected Version(s)
Jenkins Dashboard View Plugin <= 2.15
Jenkins Dashboard View Plugin 2.12.1