Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

Remediation

References

CVE-2021-21611

Related Vulnerabilities

WordPress Plugin Quick Contact Form Security Bypass (8.0.1)

PHP Out-of-bounds Write Vulnerability (CVE-2016-7126)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2022-41414)

PHP Improper Input Validation Vulnerability (CVE-2016-7129)

Magento 2.0-2.3 End of life

Severity

Medium

Classification

CVE-2021-21611 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities