Cross-site scripting in Jenkins Kiuwan Plugin

MEDIUM 6.1CVE-2021-21666 · GHSA-8h77-3xwr-hqhh · Published 10/06/2021 · updated 17/06/2026

In short

CVE-2021-21666 is a MEDIUM (CVSS 6.1) vulnerability affecting org.jenkins-ci.plugins:kiuwanJenkinsPlugin, kiuwan (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.7% of all vulnerabilities.
Fix: update to 1.6.1 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:kiuwanJenkinsPlugin Maven	`< 1.6.1`	`1.6.1`
kiuwan jenkins	`≤ 1.6.0`	No fix yet

Description

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

Only older releases of Jenkins are affected by this vulnerability. Jenkins 2.275 and newer, LTS 2.263.2 and newer include a protection preventing this from being exploitable.

Jenkins Kiuwan Plugin 1.6.1 escapes affected parts of the error message in the form validation endpoint.

NVD description

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2021-21666 · ADVISORY
jenkinsci/kiuwan-plugin commit a5f6fdb · WEB
jenkinsci/kiuwan-plugin · PACKAGE
jenkins.io/security/advisory/2021-06-10 · WEB
openwall.com/lists/oss-security/2021/06/10/14 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:kiuwanJenkinsPlugin

Maven

< 1.6.1

1.6.1

kiuwan

jenkins

≤ 1.6.0

No fix yet

Description

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

Only older releases of Jenkins are affected by this vulnerability. Jenkins 2.275 and newer, LTS 2.263.2 and newer include a protection preventing this from being exploitable.

Jenkins Kiuwan Plugin 1.6.1 escapes affected parts of the error message in the form validation endpoint.

NVD description

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.