{"id":"CVE-2021-21649","published":"2021-05-11T14:15:21Z","modified":"2024-08-03T18:16:23Z","title":"Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting…","vendor":"Jenkins project","product":"Jenkins Dashboard View Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Dashboard View Plugin","versions":[">= unspecified, <= 2.15"]}],"description":{"text":"Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins Dashboard View Plugin, version 2.15 and earlier, fails to escape URLs referenced in its Image Dashboard Portlets, which is the component where the flaw lives. An attacker with View/Configure permission on Jenkins can store a cross-site scripting payload through these URLs, so it executes in the browser of other users who view the affected dashboard.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:33Z"},"cvss":null,"epss":{"score":0.72678,"percentile":0.99443,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2233","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","vulnerableRanges":[">=2.13, <2.16","<2.12.1"],"patched":["2.16","2.12.1"],"from":["GHSA-jwhm-9cjm-4493"],"provenance":"source"}],"advisories":[{"id":"GHSA-jwhm-9cjm-4493","url":"https://github.com/advisories/GHSA-jwhm-9cjm-4493","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","vulnerableRanges":[">=2.13, <2.16"],"patched":["2.16"],"provenance":"source","from":"GHSA"},{"id":"GHSA-jwhm-9cjm-4493","url":"https://github.com/advisories/GHSA-jwhm-9cjm-4493","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","vulnerableRanges":["<2.12.1"],"patched":["2.12.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-1350","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1350","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-21649","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9944"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2019-10396","published":"2019-09-12","fixed":"2.12","kev":false,"link":{"from":"CVE-2019-10396","to":"CVE-2021-21649","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:dashboard-view","fromFixed":"2.12","toFixed":"2.12.1","daysApart":607},{"kind":"similar","provenance":"machine","score":0.41,"basis":"same product + description similarity"}]}},{"cve":"CVE-2021-21649","published":"2021-05-11","fixed":"2.16","kev":false},{"cve":"CVE-2022-27197","published":"2022-03-15","fixed":"2.18.1","kev":false,"link":{"from":"CVE-2021-21649","to":"CVE-2022-27197","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:dashboard-view","fromFixed":"2.16","toFixed":"2.18.1","daysApart":308},{"kind":"similar","provenance":"machine","score":0.43,"basis":"same product + description similarity"}]}}],"package":"Maven:org.jenkins-ci.plugins:dashboard-view"}}