medium6.1
CVE-2021-21613
XSS vulnerability in Jenkins TICS Plugin
Impact
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses. This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content. Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:tics | <= 2020.3.0.6 | 2020.3.0.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Tics | through 2020.3.0.6 |