Jenkins project · Jenkins Scriptler Plugin
The Jenkins Scriptler Plugin (version 3.2 and earlier) fails to escape parameter names displayed in job configuration forms, creating a stored cross-site scripting flaw in the plugin's configuration interface. An attacker holding Scriptler/Configure permission can exploit this by storing malicious script in a parameter name, which then executes in the browser of any user who views the affected job configuration form.
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Disclosed on 16 Jun 2021. No public exploit code or confirmed exploitation is recorded.
3 fixes in scriptler over 5 months. The latest fix listed for scriptler is 3.4.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:scriptler.
Upgrade to 3.3 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-21668).
Set the version to 3.3 or later in your pom.xml or build.gradle.
The first fix for CVE-2021-21667.
| If you run | Upgrade to |
|---|---|
| All versions before 3.3 | 3.3 |
“Up to” means the second version is the fix and is not affected.