CVE-2021-21603: 
Java vulnerability analysis and mitigation

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier contains a cross-site scripting (XSS) vulnerability due to improper escaping of notification bar response contents. The vulnerability was discovered on January 13, 2021, and is tracked as CVE-2021-21603 (Jenkins Advisory).

The vulnerability stems from Jenkins' failure to properly escape notification bar response contents, which are typically shown after form submissions via the Apply button. The severity is rated as High with a CVSS v3.1 base score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

This cross-site scripting vulnerability can be exploited by attackers who have the ability to influence notification bar contents. Successful exploitation could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to session hijacking, credential theft, or other malicious actions (Jenkins Advisory).

The vulnerability is exploitable by attackers who can influence notification bar contents. The attack requires low attack complexity but does need user interaction and low privileges for successful exploitation (NVD).

The vulnerability was fixed in Jenkins 2.275 and LTS 2.263.2, which properly escapes the content shown in notification bars. Users are advised to upgrade to these versions or later to address the vulnerability (Jenkins Advisory).