Stored XSS Vulnerability in Jenkins Git Plugin Affects Developer Tools
CVE-2021-21684

6.1MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Git Plugin
Vendor
CVE Published:
6 October 2021

Summary

The Jenkins Git Plugin, specifically versions 4.8.2 and earlier, contains a vulnerability where Git SHA-1 checksum parameters are not properly escaped. This oversight allows attackers to inject harmful scripts into the build cause, resulting in a stored cross-site scripting (XSS) vulnerability. When users view build notifications, these scripts can execute in their browsers, potentially compromising user data and affecting application integrity. It is critical for organizations using the affected versions of the Git Plugin to apply the necessary updates to mitigate this serious threat.

Affected Version(s)

Jenkins Git Plugin <= 4.8.2

Jenkins Git Plugin 4.7.1.1

Jenkins Git Plugin 4.3.1

References

https://www.jenkins.io/security/advisory/2021-10-06/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/10/06/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.