CVE-2021-22510
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
- Record
CVE-2021-22510- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
- Record
CVE-2021-22510- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2022-3933 No score
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
- Record
EUVD-2022-3933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc2r-ccfh-62v9
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape user input in a form validation response.
This results in a reflected cross-site scripting (XSS) vulnerability.
Micro Focus Application Automation Tools Plugin 6.8 escapes user input in the affected form validation response.
A security hardening since Jenkins 2.275 and LTS 2.263.2 prevents exploitation of this vulnerability.
- Record
GHSA-gc2r-ccfh-62v9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-gc2r-ccfh-62v9
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape user input in a form validation response.
This results in a reflected cross-site scripting (XSS) vulnerability.
Micro Focus Application Automation Tools Plugin 6.8 escapes user input in the affected form validation response.
A security hardening since Jenkins 2.275 and LTS 2.263.2 prevents exploitation of this vulnerability.
- Record
GHSA-gc2r-ccfh-62v9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:hp-application-automation-tools-pluginMaven |
through 6.7 | 6.8 |
org.jenkins-ci.plugins:hp-application-automation-tools-pluginMaven |
before 6.8, plus listed versions 1.01.0.22.0.02.0.23.0.5 Show 45 moreShow less3.0.63.0.74.04.0.14.5.05.05.0.0-beta-15.15.1-beta-15.1.0.1-beta5.1.0.2-beta5.25.2.0.1-beta5.35.3.1-beta5.3.2-beta5.3.3-beta5.3.4-beta5.45.4.1-beta5.4.2-beta5.55.5.1-beta5.5.2-beta5.5.3-beta5.5.4-beta5.65.6.15.6.25.6.3-beta5.6.4-beta5.6.5-beta5.75.7.1-beta5.7.2-beta5.7.3-beta5.7.4-beta5.85.8.1-beta5.8.2-beta5.8.3-beta5.8.4-beta5.8.5-beta5.8.6-beta5.8.7-beta |
6.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22510 is a medium vulnerability (CVSS 6.1) in Microfocus Application Automation Tools, published April 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.15%, the 92nd percentile. Fixed in org.jenkins-ci.plugins:hp-application-automation-tools-plugin 6.8.
References
Left out here: 43 versions. The JSON record has them.