CVE-2021-21610: Cross-site Scripting

January 13, 2021 (updated November 2, 2023)

Jenkins does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

References

nvd.nist.gov/vuln/detail/CVE-2021-21610
www.jenkins.io/security/advisory/2021-01-13/

Code Behaviors & Features

Detect and mitigate CVE-2021-21610 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →