XSS vulnerability in Jenkins TICS Plugin

MEDIUM 6.1CVE-2021-21613 · GHSA-xmw5-45v9-pxqx · Published 13/01/2021 · updated 17/06/2026

In short

CVE-2021-21613 is a MEDIUM (CVSS 6.1) vulnerability affecting io.jenkins.plugins:tics, tics (jenkins).
Chance of exploitation in the next 30 days (EPSS): 0.96%, higher than 61.6% of all vulnerabilities.
Fix: update to 2020.3.0.7 or later.

Package	Affected versions	Patched versions
io.jenkins.plugins:tics Maven	`< 2020.3.0.7`	`2020.3.0.7`
tics jenkins	`≤ 2020.3.0.6`	No fix yet

Description

Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.

NVD description

Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

References

nvd.nist.gov/vuln/detail/CVE-2021-21613 · ADVISORY
jenkinsci/tics-plugin commit a64493c · WEB
jenkinsci/tics-plugin · PACKAGE
jenkins.io/security/advisory/2021-01-13 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free