BIT-jenkins-2021-21610

Import Source

https://github.com/bitnami/vulndb/tree/main/data/jenkins/BIT-jenkins-2021-21610.json

Aliases

• CVE-2021-21610
• GHSA-7qf3-c2q8-69m3

Published

2024-03-06T11:02:44.288Z

Modified

2024-03-06T11:25:28.861Z

Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

References

• https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2153