VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 16, 2021· Updated Aug 3, 2024

CVE-2021-21667

CVE-2021-21667

Description

Jenkins Scriptler Plugin 3.2 and earlier stores parameter names unescaped, enabling stored XSS for users with Scriptler/Configure permission.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Jenkins Scriptler Plugin 3.2 and earlier stores parameter names unescaped, enabling stored XSS for users with Scriptler/Configure permission.

Vulnerability

Jenkins Scriptler Plugin versions 3.2 and earlier fail to escape parameter names displayed in job configuration forms [1][2]. This allows an attacker with Scriptler/Configure permission to inject malicious script code into parameter names that will be stored and later rendered unsafely in the configuration UI.

Exploitation

An attacker must have the Scriptler/Configure permission in Jenkins. They can craft a parameter name containing JavaScript code when creating or editing a script via the Scriptler plugin [1][4]. When a user with sufficient privileges views the job configuration form, the injected script executes in the context of their session due to missing escaping [3].

Impact

Successful exploitation leads to stored cross-site scripting (XSS). The attacker can execute arbitrary JavaScript in the victim's browser, potentially stealing session cookies, modifying Jenkins configuration, or performing actions on behalf of the victim with the same privileges [1][4].

Mitigation

Jenkins released Scriptler Plugin version 3.3 containing the fix on June 16, 2021 [4]. All users should upgrade to 3.3 or later. The commit [3] addresses the escaping issue. No workarounds are documented for older versions.

References
  1. NVD - CVE-2021-21667
  2. GitHub - jenkinsci/scriptler-plugin: Jenkins scriptler plugin
  3. SECURITY-2224 · jenkinsci/scriptler-plugin@ea9c4e6
  4. security - Multiple vulnerabilities in Jenkins plugins

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.plugins:scriptlerMaven
< 3.33.3

Affected products

2

Patches

1
ea9c4e6abdd1

SECURITY-2224

https://github.com/jenkinsci/scriptler-pluginMichael TughanJun 11, 2021via ghsa
commit
1 file changed · +1 −1
  • src/main/webapp/lib/scriptler.js+1 −1 modified
    @@ -27,7 +27,7 @@ function scriptler_descArguments(referenceTag, params){
 			   desc += j+": "+ params[j].name +" ";
 		   }
 		   var descriptionTag = document.getElementsByName('scriptlerParameters').item(i);
-		   descriptionTag.innerHTML = desc;
+		   descriptionTag.innerText = desc;
 	   }
     }	   
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

1