GitHub Advisoryadvisory · Maven

GHSA-f9gf-2q87-5m44 Stored XSS vulnerability in Jenkins Scriptler Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21700
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:scriptler
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-15

Affected packages

• Maven org.jenkins-ci.plugins:scriptler: < 3.4 → fixed in 3.4

Description

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts. Jenkins Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.

Related

Alias · CVE (1)

  • CVE-2021-21700 Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References