CVE-2021-21619
24.02.2021, 16:15
Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.
| Vendor | Product | Version |
|---|---|---|
| jenkins | claim | 𝑥 ≤ 2.18.1 |
𝑥
= Vulnerable software versions