Stored XSS Vulnerability in Jenkins Git Plugin Affects Developer Tools
CVE-2021-21684

6.1MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Git Plugin
Vendor
CVE Published:
6 October 2021

What is CVE-2021-21684?

The Jenkins Git Plugin, specifically versions 4.8.2 and earlier, contains a vulnerability where Git SHA-1 checksum parameters are not properly escaped. This oversight allows attackers to inject harmful scripts into the build cause, resulting in a stored cross-site scripting (XSS) vulnerability. When users view build notifications, these scripts can execute in their browsers, potentially compromising user data and affecting application integrity. It is critical for organizations using the affected versions of the Git Plugin to apply the necessary updates to mitigate this serious threat.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Git Plugin <= 4.8.2

Jenkins Git Plugin 4.7.1.1

Jenkins Git Plugin 4.3.1

References

https://www.jenkins.io/security/advisory/2021-10-06/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/10/06/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.