CVE-2021-21613: XSS vulnerability in Jenkins TICS Plugin
Summary
CVE-2021-21613: XSS vulnerability in Jenkins TICS Plugin. Affects io.jenkins.plugins:tics versions < 2020.3.0.7. Fixed in 2020.3.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins TICS Plugin is a Maven package that provides integration with the TICS service. It allows users to analyze and manage their code quality and compliance. The plugin interacts with the TICS service to retrieve and display information. However, versions 2020.3.0.6 and earlier of the TICS Plugin do not properly escape the TICS service responses, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control the content of the TICS service response. The issue has been addressed in version 2020.3.0.7 of the TICS Plugin, which escapes or strips HTML from the TICS service responses as necessary.
Vulnerability Detail
The XSS vulnerability in the Jenkins TICS Plugin arises from the failure to properly escape TICS service responses. Attackers who can manipulate the content of the TICS service response can inject malicious scripts into the plugin's output. This can lead to various consequences, including the execution of arbitrary code in the context of the user's browser, unauthorized access to sensitive information, and potential further attacks against users of the affected Jenkins instance. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2020.3.0.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the TICS Plugin as soon as possible.
Conclusion
The XSS vulnerability in the Jenkins TICS Plugin (CVE-2021-21613) allows attackers to execute arbitrary code in the user's browser, potentially leading to unauthorized access to sensitive information and further attacks. Users should upgrade to version 2020.3.0.7 or later of the TICS Plugin to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:tics →
FAQ
The vulnerability allows attackers to execute arbitrary code in the user's browser, potentially leading to unauthorized access to sensitive information and further attacks against the affected Jenkins instance.
No, only versions 2020.3.0.6 and earlier are affected. Version 2020.3.0.7 and later have addressed the vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the TICS Plugin.
To update the TICS Plugin, follow the standard update process for Jenkins plugins. This typically involves accessing the Jenkins administration interface, navigating to the plugin management section, and selecting the option to update the TICS Plugin.
You can find more information about the vulnerability in the GitHub Advisory Database. The vulnerability identifier is GHSA-xmw5-45v9-pxqx.
