CVE-2021-21619: 
Java vulnerability analysis and mitigation

CVE-2021-21619 affects the Jenkins Claim Plugin versions 2.18.1 and earlier. The vulnerability was discovered and disclosed on February 24, 2021. This security flaw is a cross-site scripting (XSS) vulnerability that occurs because the plugin does not properly escape user display names shown in claims (Jenkins Advisory).

The vulnerability is a stored cross-site scripting (XSS) issue in the Jenkins Claim Plugin. The root cause is the plugin's failure to escape user display names when showing claims. The severity is rated as High according to CVSS scoring system (Jenkins Advisory).

The vulnerability allows cross-site scripting attacks that can be exploited by attackers who have the ability to control the display names of Jenkins users. This control can be achieved either through the security realm or directly within Jenkins. It's important to note that any user with a Jenkins account can modify their own display name, increasing the potential attack surface (Jenkins Advisory, OSS Security).

The vulnerability is exploitable by any attacker who can control Jenkins user display names. The attack vector is particularly concerning because every user with a Jenkins account has the ability to change their own display name, making the vulnerability relatively easy to exploit (Jenkins Advisory).

The vulnerability has been fixed in Jenkins Claim Plugin version 2.18.2, which properly escapes the user display name shown in claims. Users are strongly advised to upgrade to this version or later to address the security issue (Jenkins Advisory).