Patchfirst
Patchfirst
CVE-2021-21668 EPSS 76.0%

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Jenkins project · Jenkins Scriptler Plugin

Summary

The Jenkins Scriptler Plugin, version 3.1 and earlier, fails to escape script content, which creates a stored cross-site scripting (XSS) flaw in the plugin. An attacker holding Scriptler/Configure permission can exploit it to inject script content that is stored and later executed in the context of other users' sessions.

Heading is the official description · CVE.org
Breakdown
19.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 16 Jun 2021. No public exploit code or confirmed exploitation is recorded.

3 fixes in scriptler over 5 months. The latest fix listed for scriptler is 3.4.

Fixes in scriptlerMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3.2CVE-2021-2166816 Jun 2021
  2. 3.3CVE-2021-2166716 Jun 2021
  3. 3.4CVE-2021-2170012 Nov 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:scriptler.

Mavenorg.jenkins-ci.plugins:scriptlerGHSA-5c6c-w4c4-vgvx

Upgrade to 3.3 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-21667).

Set the version to 3.3 or later in your pom.xml or build.gradle.

First fixed in 3.2 for CVE-2021-21668.

Affected versions

If you runUpgrade to
All versions before 3.23.3first fix for this CVE: 3.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

jenkins.io/security/advisory/2021-06-16/#SECURITY-2390

mailing-list 1

openwall.com/lists/oss-security/2021/06/16/3
↑ ↓ chooseEnter openEsc close