CVE-2021-21610

medium CVSS 6.1 EPSS 1.2%

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

Versions it affects

Software versions checked with the free lookup that CVE-2021-21610 applies to, and the release that fixes it where the sources name one.

Jenkins 1.509

At a glance

Severity: Medium
CVSS base score: 6.1 out of 10
Known exploited: Not in CISA's catalogue of exploited vulnerabilities
EPSS: 1.2% probability of exploitation in the next 30 days, higher than 67% of scored vulnerabilities
Weakness: CWE-79
Published: 2021-01-13

NVD CVE.org

Is this running somewhere in your estate?

The Vulnerability Reporter inventories every machine and tells you when an advisory like this one applies to you.

Explore the service Check another version