CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by…

published February 24, 2021

CVSS
—
EPSS
9%
Percentile
95.4
In the wild
Unconfirmed
What it is

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.09390 · 95.4th percentile
Published
2021-02-24T15:05Z
EPSS history
Timeline
  • 24 FEB 15:05Z
    Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by…
    cvelistv5