mend-for-github-com[bot]
commented
2 years ago :heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.
CVE-2021-21648 - Medium Severity Vulnerability
This plugin allows you to store credentials in Jenkins.
Library home page: https://wiki.jenkins.io/display/JENKINS/Credentials+Plugin
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.18/ffc55cb48c53c4d4122f50708a3bc771b8c4c631/credentials-2.1.18.jar,/ches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.18/ffc55cb48c53c4d4122f50708a3bc771b8c4c631/credentials-2.1.18.jar
Dependency Hierarchy: - ssh-credentials-1.10.jar (Root Library) - :x: **credentials-2.1.18.jar** (Vulnerable Library)
Found in HEAD commit: 379a0396e83ffd3481f8e9aa1d61bbcd253f00ee
Found in base branch: main
Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
Publish Date: 2021-05-11
URL: CVE-2021-21648
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.jenkins.io/security/advisory/2021-05-11/#SECURITY-2349
Release Date: 2021-05-11
Fix Resolution: org.jenkins-ci.plugins:credentials:2.3.19