CVE-2021-21684
Stored XSS vulnerability in Jenkins Git Plugin
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
CVE-2021-21684- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
CVE List No score
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
CVE-2021-21684- Updated
- 2026-11-02
EUVDEUVD-2022-3953 No score
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
EUVD-2022-3953- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gghc-g8cj-4vfv
Stored XSS vulnerability in Jenkins Git Plugin
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /git/notifyCommit endpoint.
Jenkins Git Plugin 4.8.3 rejects Git SHA-1 checksum parameters that do not match the expected format. Existing values are sanitized when displayed on the UI.
This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.
- Record
GHSA-gghc-g8cj-4vfv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-02
OSV
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
CVE-2021-21684- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-gghc-g8cj-4vfv
Stored XSS vulnerability in Jenkins Git Plugin
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /git/notifyCommit endpoint.
Jenkins Git Plugin 4.8.3 rejects Git SHA-1 checksum parameters that do not match the expected format. Existing values are sanitized when displayed on the UI.
This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.
- Record
GHSA-gghc-g8cj-4vfv- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-02
OSVRHSA-2022:0055
Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update
- Record
RHSA-2022:0055- CVSS 3.1
- 9.0 Critical
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:gitMaven |
through 4.8.2 | 4.8.3 |
org.jenkins-ci.plugins:gitMaven |
before 4.8.3, plus listed versions 1.2.01.3.01.4.01.5.01.6.0-beta-1 Show 45 moreShow less2.02.0-beta-22.0-beta-32.0.12.0.22.0.32.0.42.1.02.2.02.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.32.3-beta-12.3-beta-22.3-beta-32.3-beta-42.3.12.3.22.3.32.3.42.3.52.4.02.4.12.4.22.4.32.4.42.5.02.5.0-beta12.5.0-beta22.5.0-beta32.5.0-beta42.5.0-beta52.5.12.5.22.5.3 |
4.8.3 |
jenkinsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:2.319.2.1643288987-1.el8 | 0:2.319.2.1643288987-1.el8 |
coreos-installerRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfraRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-bootinfra-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
coreos-installer-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:0.12.0-1.rhaos4.10.el8 | 0:0.12.0-1.rhaos4.10.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.1643404185-1.el8 | 0:4.10.1643404185-1.el8 |
cri-oRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cri-o-debuginfoRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
cri-oRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
cri-o-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
openshiftRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshift-clientsRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-clients-redistributableRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
openshift-clientsRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-clients-redistributableRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 From an advisory covering 24 CVEs |
before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21684 is a medium vulnerability (CVSS 6.1) in Jenkins Git, published October 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in org.jenkins-ci.plugins:git 4.8.3.
References
jenkins.io/security/advisory/2021-10-06
openwall.com/lists/oss-security/2021/10/06/1
nvd.nist.gov/vuln/detail/CVE-2021-21684
github.com/jenkinsci/git-plugin/commit/5474cc942bfba60927be629ff47fb41c38c66741
Show 108 moreShow less
access.redhat.com/errata/RHSA-2022:0055
bugzilla.redhat.com/show_bug.cgi?id=1129074
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json
cve.org/CVERecord?id=CVE-2014-3577
groups.google.com/g/golang-announce/c/0fM21h43arc
kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster
Left out here: 88 versions. The JSON record has them.