Bug 1925145 (CVE-2021-21611)

Summary:	CVE-2021-21611 jenkins: Stored XSS vulnerability on new item page
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abenaiss, aileenc, aos-bugs, bmontgom, chazlett, dramseur, drieden, eparis, ggaughan, gmalinko, janstey, jburrell, jhunter, jochrist, jokerman, jwon, kmitts, mgala, mjudeiki, nstielau, pbhattac, sponnaga, vbobade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jenkins 2.275, jenkins LTS 2.263.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in jenkins. A cross-site scripting (XSS) vulnerability is possible due to display names and IDs of item types shown on the New Item page not being properly escaped. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-18 19:02:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1925482, 1925483, 1925484, 1925485, 1925486, 1929919, 1929921
Bug Blocks:	1925147

Description Michael Kaplan 2021-02-04 13:50:01 UTC

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

Comment 3 errata-xmlrpc 2021-02-17 19:04:55 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:0423 https://access.redhat.com/errata/RHSA-2021:0423

Comment 4 Product Security DevOps Team 2021-02-18 19:02:30 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21611

Comment 5 errata-xmlrpc 2021-03-03 04:17:50 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.5

Via RHSA-2021:0429 https://access.redhat.com/errata/RHSA-2021:0429