CVE-2021-21619

Description

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.

Risk Information

Base Score

5.4

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

0.151

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-21619,CVE-2021-21620 are fixed in Jenkins - claim 2.18.2	Windows
Vulnerabilities CVE-2021-21619,CVE-2021-21620 are fixed in Jenkins - claim for Linux 2.18.2	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234