CVE-2021-21660

描述

Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter. Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.

如何修補 CVE-2021-21660

要修補 CVE-2021-21660,請將受影響套件升級到下列已修補版本。

• —升級至 0.2.0 或更新版本

CVE-2021-21660 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.2.0

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-21660
• PATCHgithub.com/jenkinsci/markdown-formatter-plugin
• WEBgithub.com/jenkinsci/markdown-formatter-plugin/commit/6b283a5bba3424fd5174b92e7ad8724cdbdf596c
• WEBwww.jenkins.io/security/advisory/2021-05-25/#SECURITY-2198