CVE-2021-21618: Jenkins Repository Connector Plugin stored XSS via unescaped parameter names

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityRequires authenticated Item/Configure permission and victim interaction, but the stored XSS can affect other users and EPSS is very high.

What it is

Jenkins Repository Connector Plugin 2.0.2 and earlier fails to escape parameter names and descriptions for past builds, creating a stored cross-site scripting flaw. An attacker with Item/Configure permission can inject script that executes in the browser of other users viewing the affected build data.

Impact

An attacker can run arbitrary JavaScript in a victim's Jenkins session, potentially stealing session data or performing actions as the victim. The scope change in the CVSS vector means the script can affect resources beyond the vulnerable component.

Attack surface

Reachable over the network through the Jenkins web interface. The attacker needs Item/Configure permission, and a victim must view the affected past build page, so user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are provided. EPSS is high at 0.81765 (99.6th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade Jenkins Repository Connector Plugin to a version later than 2.0.2 as directed by the vendor advisory.
• Restrict Item/Configure permission to trusted users only.
• Review and remove any untrusted parameter names or descriptions in past build records.
• Apply Jenkins security hardening guidance for plugin and permission management.

Detection

• Search Jenkins build parameter names and descriptions for HTML or script tags.
• Monitor Jenkins audit logs for unexpected Item/Configure permission changes or suspicious configuration edits.
• Inspect web access logs for requests containing encoded script payloads in build parameter fields.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.