CVE-2021-21628

The CVE-2021-21628 case concerns Jenkins Build With Parameters Plugin (versions ≤ 1.5). The underlying issue is that parameter names and descriptions are not escaped, enabling stored XSS. The vulnerability can be exploited by attackers who have Job/Configure permission. Public writeups from OSV a...

CVE-2021-21629

CVE-2021-21629: A CSRF vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows an attacker to trigger builds with attacker-specified parameters via endpoints that do not require POST; patch to 1.5.1 or later is indicated by sources (OSV/GHSA/NASL) as the fix. No exploitation ...