Stored XSS vulnerability in Jenkins Scriptler Plugin

MEDIUM 5.4CVE-2021-21668 · GHSA-5c6c-w4c4-vgvx · Published 16/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:scriptler Maven	`< 3.2`	`3.2`
scriptler jenkins	`≤ 3.1`	No fix yet

Description

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Jenkins Scriptler Plugin 3.2 escapes script content.

NVD description

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21668 · ADVISORY
jenkinsci/scriptler-plugin · PACKAGE
jenkins.io/security/advisory/2021-06-16 · WEB
openwall.com/lists/oss-security/2021/06/16/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free