CVE-2021-21628: Stored XSS vulnerability in Jenkins Build With Parameters Plugin
Summary
CVE-2021-21628: Stored XSS vulnerability in Jenkins Build With Parameters Plugin. Affects org.jenkins-ci.plugins:build-with-parameters versions < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Build With Parameters Plugin is a Maven package that allows users to define and configure build parameters for Jenkins jobs. It provides a user interface for specifying parameter names, descriptions, and default values. These parameters can be used to customize the build process and enable user interaction. However, versions 1.5 and earlier of the plugin do not properly escape parameter names and descriptions, leading to a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers with Job/Configure permission to inject malicious scripts into the Jenkins interface, potentially compromising user data and system integrity.
Vulnerability Detail
The stored XSS vulnerability in Jenkins Build With Parameters Plugin arises from the lack of proper escaping of parameter names and descriptions. This allows an attacker with Job/Configure permission to inject arbitrary scripts into the Jenkins interface. When a user views a job with parameters configured using the vulnerable plugin, the injected script will be executed in their browser, potentially leading to session hijacking, data theft, or other malicious activities. The vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Latest published version: 81.ve4a_9c2499d9a as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the plugin is not immediately feasible, users can mitigate the risk by restricting Job/Configure permission to trusted individuals only. By limiting the number of users with this permission, the attack surface for potential exploiters is reduced. Additionally, users can manually sanitize parameter names and descriptions by removing any potentially malicious characters or scripts.
Conclusion
The stored XSS vulnerability in Jenkins Build With Parameters Plugin (CVE-2021-21628) poses a significant risk to Jenkins instances using versions 1.5 and earlier of the plugin. Upgrading to version 1.5.1 or later is strongly recommended to mitigate the vulnerability. Restricting Job/Configure permission and manually sanitizing parameter names and descriptions can provide temporary mitigation until the upgrade is performed. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-with-parameters →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, data theft, or other malicious activities.
Attackers with Job/Configure permission in Jenkins can exploit this vulnerability.
Yes, upgrading to version 1.5.1 or later of the Build With Parameters Plugin fixes this vulnerability.
Restricting Job/Configure permission to trusted individuals and manually sanitizing parameter names and descriptions can help mitigate the risk.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-with-parameters.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
