Not rated
CVE-2021-21684 Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit…
Description
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Git Plugin 4.8 | earliest → 4.8.2 | No fix stated |
| Jenkins Git Plugin 4.7 | earliest → < 4.7.1.1 | 4.7.1.1 |
| Jenkins Git Plugin 4.3 | earliest → < 4.3.1 | 4.3.1 |
References
- www.jenkins.io www.jenkins.io
- [oss-security] 20211006 Multiple vulnerabilities in Jenkins and Jenkins plugins www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins Git Plugin
The 7 CVEs of Jenkins Git Plugin →
CVE-2022-38663
Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log…
Not rated
CVE-2022-36884
The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlier provide unauthenticated attackers information about the…
Not rated
CVE-2022-36883
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds…
Not rated
CVE-2022-36882
A cross-site request forgery (CSRF) vulnerability in Jenkins Git Plugin 4.11.3 and earlier allows attackers to trigger…
Not rated