Stored XSS vulnerability in Jenkins Extra Columns Plugin

MEDIUM 5.4CVE-2021-21630 · GHSA-wx66-pm7r-2q82 · Published 30/03/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:extra-columns Maven	`< 1.23`	`1.23`
extra columns jenkins	`≤ 1.22`	No fix yet

Description

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build parameters column, or the attacker also needs View/Configure permission.

Jenkins Extra Columns Plugin 1.23 escapes parameter values in the build parameters column.

NVD description

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21630 · ADVISORY
jenkinsci/extra-columns-plugin commit 929887c · WEB
jenkinsci/extra-columns-plugin · PACKAGE
jenkins.io/security/advisory/2021-03-30 · WEB
openwall.com/lists/oss-security/2021/03/30/1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free