GitHub Advisoryadvisory · Maven

GHSA-xqpp-26pp-2365 XSS vulnerability in Jenkins Markdown Formatter Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21660
Ecosystem
Maven
Packages
io.jenkins.plugins:markdown-formatter
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-15

Affected packages

• Maven io.jenkins.plugins:markdown-formatter: < 0.2.0 → fixed in 0.2.0

Description

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter. Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.

Related

Alias · CVE (1)

  • CVE-2021-21660 Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References