CVE-2021-21649: Cross-site Scripting in Jenkins Dashboard View Plugin
Summary
CVE-2021-21649: Cross-site Scripting in Jenkins Dashboard View Plugin. Affects org.jenkins-ci.plugins:dashboard-view across 2 version ranges.
< 2.12.1
>= 2.13, < 2.16
Fixed in 2.12.1 or 2.16, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Dashboard View Plugin is a plugin for the Jenkins automation server that provides a customizable dashboard view for monitoring and managing Jenkins jobs. It allows users to create a dashboard with various portlets, including image portlets that display images from specified URLs. This plugin is widely used in Jenkins installations for visualizing job information and status.
Vulnerability Detail
The Jenkins Dashboard View Plugin prior to version 2.16 and 2.12.1 is vulnerable to a stored cross-site scripting (XSS) attack. The plugin does not properly escape URLs referenced in Image Dashboard Portlets, allowing an attacker with View/Configure permission to inject malicious scripts into the dashboard. This vulnerability can be exploited to execute arbitrary code in the context of other users who view the affected dashboard. The vulnerability has a CVSS score of 8.0, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.12.12.12.1 -
>= 2.13, < 2.162.16
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually escape the URLs referenced in Image Dashboard Portlets. This can be done by modifying the affected dashboard configuration and ensuring that the URLs are properly encoded or sanitized to prevent script injection. Here is an example of how to encode a URL in JavaScript:
var encodedUrl = encodeURIComponent(url);
Conclusion
The Jenkins Dashboard View Plugin prior to version 2.16 and 2.12.1 is vulnerable to a stored cross-site scripting (XSS) attack. Upgrading to the fixed version or applying the recommended workaround will mitigate the risk of this vulnerability. It is important to promptly address this issue to prevent unauthorized access and potential exploitation of the Jenkins server. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:dashboard-view →
FAQ
This vulnerability allows an attacker to inject malicious scripts into the Jenkins dashboard, potentially leading to unauthorized access, data theft, or further exploitation of the Jenkins server.
Users of Jenkins Dashboard View Plugin versions prior to 2.16 and 2.12.1 are affected by this vulnerability. Users with View/Configure permission are particularly at risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is advisable to apply the recommended fix or workaround as soon as possible to mitigate the risk.
No, this vulnerability requires an attacker to have View/Configure permission in Jenkins. However, if an attacker gains such permissions, the vulnerability can be exploited remotely by tricking users with access to the affected dashboard into visiting a specially crafted URL.
Yes, this vulnerability has a CVSS score of 8.0, indicating a high severity. The CVSS score is based on the technical details of the vulnerability and helps assess its potential impact and urgency for remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:dashboard-view.
