Stored XSS vulnerability in Jenkins Build With Parameters Plugin

MEDIUM 5.4CVE-2021-21628 · GHSA-xjrg-6fv9-6rjg · Published 30/03/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:build-with-parameters Maven	`< 1.5.1`	`1.5.1`
build with parameters jenkins	`≤ 1.5`	No fix yet

Description

Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Build With Parameters Plugin 1.5.1 escapes parameter names and descriptions.

NVD description

Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21628 · ADVISORY
jenkinsci/build-with-parameters-plugin commit edbc286 · WEB
jenkinsci/build-with-parameters-plugin · PACKAGE
jenkins.io/security/advisory/2021-03-30 · WEB
openwall.com/lists/oss-security/2021/03/30/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free