Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-21608)

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

Remediation

References

CVE-2021-21608

Related Vulnerabilities

WordPress Plugin iThemes Security (formerly Better WP Security) Security Bypass (7.9.0)

WordPress Plugin NextGEN Gallery-WordPress Gallery Arbitrary File Upload (1.9.12)

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Cross-Site Scripting (2.10.3)

PHP Numeric Errors Vulnerability (CVE-2016-4344)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-23178)

Severity

Medium

Classification

CVE-2021-21608 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N