cve.bz

CVE-2021-21648

6.1 mediumEPSS 11%

Medium (6.1) in jenkins credentials. EPSS 11% chance of exploitation in the next 30 days. Fixed in org.jenkins-ci.plugins:credentials 2.3.0.1, 2.3.13.1, 2.3.14.1.

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials>=2.3.16 <2.3.192.3.19
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials>=2.3.15 <2.3.15.12.3.15.1
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials>=2.3.14 <2.3.14.12.3.14.1
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials>=2.3.8 <2.3.13.12.3.13.1
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials>=2.3.1 <2.3.7.12.3.7.1
GHSA-gchq-9r68-6jwvMavenorg.jenkins-ci.plugins:credentials<2.3.0.12.3.0.1

References

Check your stackJSON