CVE-2021-21630: 
Java vulnerability analysis and mitigation

CVE-2021-21630 is a stored cross-site scripting (XSS) vulnerability discovered in the Jenkins Extra Columns Plugin versions 1.22 and earlier. The vulnerability was disclosed on March 30, 2021, affecting the build parameters column functionality of the plugin (Jenkins Advisory).

The vulnerability stems from the Extra Columns Plugin's failure to properly escape parameter values in the build parameters column. This security flaw is classified with a High severity CVSS score. The vulnerability is tracked as SECURITY-2222 and requires specific conditions to be exploitable, including access to Job/Configure permissions (Jenkins Advisory).

The vulnerability allows attackers with Job/Configure permission to execute stored cross-site scripting (XSS) attacks through the build parameters column. For successful exploitation, either a view containing the affected job needs to be configured with the build parameters column, or the attacker requires additional View/Configure permission (Jenkins Advisory).

The vulnerability has been fixed in Extra Columns Plugin version 1.23, which properly escapes parameter values in the build parameters column. Users are advised to update to this version to mitigate the security risk (Jenkins Advisory).