Vulnerability record · CVE-2021-21630 · published 30 March 2021
CVE-2021-21630: Jenkins Extra Columns Plugin stored XSS via unescaped build parameter values
Jenkins · Extra Columns
Jenkins Extra Columns Plugin 1.22 and earlier fails to escape parameter values shown in the build parameters column, creating a stored cross-site scripting flaw. Because the injected script persists in build data and renders for other users viewing the column, it can affect users beyond the one who inserted it.
Description
Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Automated analysis
medium priorityCVSS rates it medium (5.4) and exploitation requires authenticated Job/Configure permission plus victim interaction, though the high EPSS score warrants prompt patching.
What it is
Jenkins Extra Columns Plugin 1.22 and earlier fails to escape parameter values shown in the build parameters column, creating a stored cross-site scripting flaw. Because the injected script persists in build data and renders for other users viewing the column, it can affect users beyond the one who inserted it.
Impact
An attacker with Job/Configure permission can store script that executes in the browser of any user who views the affected column, enabling session theft or actions as the victim. The CVSS vector limits scope to low confidentiality and integrity impact.
Attack surface
Reached over the network through the Jenkins web UI; the attacker needs Job/Configure permission, and a victim must view the build parameters column for the payload to run, so user interaction is required.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is high at 0.72391 (99.41st percentile), indicating elevated predicted exploitation likelihood.
What to do
- Upgrade Jenkins Extra Columns Plugin past 1.22 to the fixed release named in the Jenkins security advisory SECURITY-2222.
- If immediate upgrade is not possible, restrict Job/Configure permission to trusted users only.
- Review and remove any stored build parameter values containing HTML or script content.
- Apply a restrictive Content-Security-Policy to the Jenkins UI to reduce script execution impact.
Detection
- Search Jenkins build parameter values and job configurations for HTML tags, script elements, or event handler attributes.
- Monitor Jenkins audit logs for Job/Configure permission changes or configuration updates by unexpected accounts.
- Inspect HTTP requests and responses to the Extra Columns build parameters view for reflected or stored script payloads.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2021/03/30/1 | Mailing ListThird Party Advisory |
| https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2222 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2021/03/30/1 | Mailing ListThird Party Advisory |
| https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2222 | Vendor Advisory |
Track CVE-2021-21630 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-21630), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
