What is GHSA-xmw5-45v9-pxqx?

GHSA-xmw5-45v9-pxqx is a security advisory published by GitHub Security Advisories with Medium severity. XSS vulnerability in Jenkins TICS Plugin

Which CVE IDs does GHSA-xmw5-45v9-pxqx cover?

GHSA-xmw5-45v9-pxqx covers the following CVE IDs: CVE-2021-21613. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xmw5-45v9-pxqx?

GHSA-xmw5-45v9-pxqx has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-xmw5-45v9-pxqx?

GHSA-xmw5-45v9-pxqx affects 1 product, including: maven/io.jenkins.plugins:tics:\u003c= 2020.3.0.6.

GHSA-xmw5-45v9-pxqxMediumCVSS 6.1

XSS vulnerability in Jenkins TICS Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 14, 2023

🔗 CVE IDs covered (1)

CVE-2021-21613 →

📋 Description

Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.

🎯 Affected products1

maven/io.jenkins.plugins:tics:<= 2020.3.0.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-21613
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2098
https://github.com/jenkinsci/tics-plugin/commit/a64493ccf81a241c5e51736721c4fe9a3e56622b
https://github.com/advisories/GHSA-xmw5-45v9-pxqx