Not rated
CVE-2021-21667 Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting…
Description
Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Scriptler Plugin 3.2 | earliest → 3.2 | No fix stated |
Other CVEs of Jenkins Scriptler Plugin
The 5 CVEs of Jenkins Scriptler Plugin →
CVE-2023-50765
A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read…
Not rated
CVE-2023-50764
Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP…
Not rated
CVE-2021-21700
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their…
Not rated
CVE-2021-21668
Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting…
Not rated