CVE-2021-21613
XSS vulnerability in Jenkins TICS Plugin
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
- Record
CVE-2021-21613- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
- Record
CVE-2021-21613- Updated
- 2026-11-02
EUVDEUVD-2022-5830 No score
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
- Record
EUVD-2022-5830- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xmw5-45v9-pxqx
XSS vulnerability in Jenkins TICS Plugin
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.
This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.
- Record
GHSA-xmw5-45v9-pxqx- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-21613
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
- Record
ALPINE-CVE-2021-21613- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSVGHSA-xmw5-45v9-pxqx
XSS vulnerability in Jenkins TICS Plugin
Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.
This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.
- Record
GHSA-xmw5-45v9-pxqx- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:ticsMaven |
through 2020.3.0.6 | 2020.3.0.7 |
jenkinsAlpine:v3.12 |
before 2.275-r0 | 2.275-r0 |
io.jenkins.plugins:ticsMaven |
before 2020.3.0.7, plus listed versions 1.02020.3.0.02020.3.0.12020.3.0.22020.3.0.42020.3.0.6 |
2020.3.0.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21613 is a medium vulnerability (CVSS 6.1) in Jenkins Tics, published January 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in io.jenkins.plugins:tics 2020.3.0.7.