{"id":"CVE-2021-21700","published":"2021-11-12T10:35:17Z","modified":"2024-08-03T18:23:29Z","title":"Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their…","vendor":"Jenkins","product":"Jenkins Scriptler Plugin","tier":"tail","description":{"text":"Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by exploitable by attackers able to create Scriptler scripts.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00707,"percentile":0.53286,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2406","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2021/11/12/1","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":10.7,"factors":[{"name":"EPSS percentile","points":10.66}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Scriptler Plugin","versions":[">= unspecified, <= 3.3"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:scriptler","vulnerableRanges":["<3.4"],"patched":["3.4"],"from":["GHSA-f9gf-2q87-5m44"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3736","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-21668","published":"2021-06-16","fixed":"3.2","kev":false},{"cve":"CVE-2021-21667","published":"2021-06-16","fixed":"3.3","kev":false,"link":{"from":"CVE-2021-21667","to":"CVE-2021-21700","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:scriptler","fromFixed":"3.3","toFixed":"3.4","daysApart":149}]}},{"cve":"CVE-2021-21700","published":"2021-11-12","fixed":"3.4","kev":false}],"package":"Maven:org.jenkins-ci.plugins:scriptler"}}