CVE-2021-21608
Java vulnerability analysis and mitigation

Overview

CVE-2021-21608 is a stored cross-site scripting (XSS) vulnerability discovered in Jenkins versions 2.274 and earlier, and LTS 2.263.1 and earlier. The vulnerability was disclosed on January 13, 2021, and is identified as SECURITY-2035 in Jenkins security tracking. The issue affects the Jenkins core functionality, specifically related to the handling of button labels in the Jenkins UI (Jenkins Advisory).

Technical details

The vulnerability stems from Jenkins' failure to properly escape button labels in the user interface. A notable example of this vulnerability can be observed in the buttons of the Pipeline input step. The severity is rated as High according to CVSS scoring system. The vulnerability was fixed in Jenkins 2.275 and LTS 2.263.2 by implementing proper escaping of button labels in the Jenkins UI (Jenkins Advisory).

Impact

This cross-site scripting vulnerability allows attackers with the ability to control button labels to inject malicious scripts into the Jenkins UI. When executed, these scripts run in the context of other users' browsers who view the affected buttons, potentially leading to session hijacking, credential theft, or other malicious actions (Jenkins Advisory).

Exploitability

The vulnerability is exploitable by attackers who have the ability to control button labels within the Jenkins interface. This could include users with appropriate permissions to modify Pipeline input steps or similar functionality where button labels can be customized (Jenkins Advisory).

Mitigation and workarounds

The recommended mitigation is to upgrade to Jenkins 2.275 or LTS 2.263.2 or later versions, which include the fix for this vulnerability. The fix implements proper escaping of button labels in the Jenkins UI to prevent XSS attacks (Jenkins Advisory).

Community reactions

The vulnerability was discovered and reported by Matt Sicker and Jesse Glick from CloudBees, Inc., demonstrating the active security research within the Jenkins community (Jenkins Advisory).

Additional resources


SourceThis report was generated using AI

Related Java vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-58400CRITICAL9.1
  • Java logoJava
  • org.geonetwork-opensource:gs-web-app
NoYesSep 03, 2026
CVE-2026-63219HIGH8.6
  • Java logoJava
  • org.geonetwork-opensource:gn-services
NoYesSep 03, 2026
CVE-2026-49832HIGH8
  • Java logoJava
  • org.dspace:dspace-api
NoYesSep 02, 2026
CVE-2026-49833MEDIUM5.5
  • Java logoJava
  • org.dspace:dspace-api
NoYesSep 02, 2026
CVE-2026-49831MEDIUM5.5
  • Java logoJava
  • org.dspace:dspace-api
NoYesSep 02, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management