vulnerability

Red Hat OpenShift: CVE-2021-21608: jenkins: Stored XSS vulnerability in button labels

Name: Red Hat OpenShift: CVE-2021-21608: jenkins: Stored XSS vulnerability in button labels
Creator: Red Hat
Published: 2021-01-13T00:00:00.000Z
Keywords: CVE, CWE-79, Red Hat OpenShift, 2021, 21608, jenkins, linuxrpm-upgrade-conmon, linuxrpm-upgrade-jenkins, linuxrpm-upgrade-machine-config-daemon, linuxrpm-upgrade-openshift, linuxrpm-upgrade-openshift-ansible, linuxrpm-upgrade-openshift-clients, linuxrpm-upgrade-runc, Severity 4

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Jan 13, 2021

Added

Feb 19, 2021

Modified

Mar 30, 2026

Description

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.

Solutions

linuxrpm-upgrade-conmonlinuxrpm-upgrade-jenkinslinuxrpm-upgrade-machine-config-daemonlinuxrpm-upgrade-openshiftlinuxrpm-upgrade-openshift-ansiblelinuxrpm-upgrade-openshift-clientslinuxrpm-upgrade-runc

References

CVE-2021-21608
https://attackerkb.com/topics/CVE-2021-21608
CWE-79
EUVD-EUVD-2022-5639
REDHAT-RHSA-2021:0423
REDHAT-RHSA-2021:0429
REDHAT-RHSA-2021:0637
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5639

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report