Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

Remediation

References

CVE-2021-21611

Related Vulnerabilities

WordPress Plugin Database for Contact Form 7, WPforms, Elementor forms Cross-Site Scripting (1.3.8)

MySQL CVE-2017-3251 Vulnerability (CVE-2017-3251)

WordPress Plugin WordPress fancyBox Lightbox Cross-Site Scripting (1.0.1)

WordPress Plugin Connections Business Directory CSV Injection (9.6)

PHP Improper Input Validation Vulnerability (CVE-2011-0752)

Severity

Medium

Classification

CVE-2021-21611 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities