Jenkins Dashboard View Plugin Cross-Site Scripting (CVE-2021-21649)

A stored cross-site scripting vulnerability exists in Jenkins Dashboard View Plugin. This vulnerability is due to insufficient validation of user-controlled information...

org.jenkins-ci.plugins:project-build-times (>=1.0 <=1.2.1), org.jenkins-ci.plugins:project-stats-plugin (>=0.1 <=0.4) potentially affected by CVE-2021-21649 via org.jenkins-ci.plugins:dashboard-view (>=2.0 <=2.0.2)

org.jenkins-ci.plugins:dashboard-view MAVEN version =2.0, =1.0, =0.1, =0.4 Source cves: CVE-2021-21649 Source advisory: OSV:GHSA-JWHM-9CJM-4493...

CVE-2021-21649

CVE-2021-21649 affects Jenkins Dashboard View Plugin (versions 2.15 and earlier). The vulnerability arises from not escaping URLs in Image Dashboard Portlets, allowing stored XSS via adversaries with View/Configure permission. The in-document details specify a stored XSS impact with user-controll...

CVE-2021-21649

Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission...