Name: CVE-2021-21608: Improper Neutralization of Input During Web Page Generation
Creator: Rapid7
Published: 2021-01-13T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2021-21608, CWE-79, CVSS 5.4, EPSS 0.01041

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

CVSS Details

CVSS 3.1 Base Score: 5.4
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade jenkins	Aug 22, 2024	Jan 13, 2021
Arch Linux	—	Upgrade to the latest version of Arch Linux	Jul 11, 2025	Jan 13, 2021
Jenkins 2021 01 13	—	Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.275Upgrade Jenkins LTS to version 2.263.2	Dec 2, 2021	Jan 13, 2021
Redhat Openshift	—	Upgrade openshift-kuryrUpgrade python-oslo-configUpgrade ironic-images-ipa-ppc64leUpgrade python-oslo-dbUpgrade ironic-imagesUpgrade python-oslo-policyUpgrade butaneUpgrade python-oslo-i18nUpgrade kata-containersUpgrade openvswitch2.15Upgrade openshift-clientsUpgrade cri-toolsUpgrade python-toozUpgrade toolboxUpgrade ignitionUpgrade openshift-ansibleUpgrade python-ironic-prometheus-exporterUpgrade ironic-images-ipa-x86_64Upgrade haproxyUpgrade python-eventletUpgrade cri-oUpgrade python-oslo-utilsUpgrade python-oslo-concurrencyUpgrade redhat-release-coreosUpgrade machine-config-daemonUpgrade python-kubernetesUpgrade python-openstacksdkUpgrade coreos-installerUpgrade rteval-loadsUpgrade ostreeUpgrade python-oslo-logUpgrade python-keystoneauth1Upgrade conmonUpgrade atomic-openshift-service-idlerUpgrade python-oslo-serializationUpgrade python-debtcollectorUpgrade openstack-ironicUpgrade python-oslo-contextUpgrade openstack-ironic-python-agentUpgrade runcUpgrade openstack-ironic-inspectorUpgrade python-jsonschemaUpgrade ovn2.13Upgrade openshiftUpgrade python-openshiftUpgrade podmanUpgrade console-login-helper-messagesUpgrade python-sushy-oem-idracUpgrade rust-afterburnUpgrade python-ironic-lib	Feb 19, 2021	Jan 13, 2021

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence