CVE-2021-21610

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami jenkins

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.274.1"}]}]

Références

advisory jenkins.io
web nvd.nist.gov