GHSA-98gq-6hxg-52r6MediumCVSS 5.4

XSS vulnerability in Jenkins notification bar

Published
May 24, 2022
Last Modified
December 14, 2023

🔗 CVE IDs covered (1)

CVE-2021-21603 →

📋 Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.

Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.

🎯 Affected products2

  • maven/org.jenkins-ci.main:jenkins-core:< 2.263.1
  • maven/org.jenkins-ci.main:jenkins-core:>= 2.263.2, <= 2.274

🔗 References (4)