CVE-2021-21700: 
Java vulnerability analysis and mitigation

Jenkins Scriptler Plugin versions 3.3 and earlier contain a stored cross-site scripting (XSS) vulnerability (CVE-2021-21700) discovered in November 2021. The vulnerability exists in the script deletion confirmation UI where the plugin fails to properly escape script names (Jenkins Advisory, OSS Security).

The vulnerability is classified as a stored XSS vulnerability with a CVSS v3.1 Base Score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The core issue stems from the plugin's failure to properly escape script names in the UI when confirming script deletion operations (NVD).

This vulnerability allows attackers with the ability to create Scriptler scripts to execute cross-site scripting attacks when other users attempt to delete scripts. The successful exploitation could lead to unauthorized access to sensitive information and potential manipulation of the Jenkins interface (Jenkins Advisory).

The vulnerability has been fixed in Scriptler Plugin version 3.4, which properly escapes script names on the UI when confirming script deletion. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).

The vulnerability was discovered and reported by Guy Lederfein of Trend Micro, demonstrating ongoing security research in the Jenkins plugin ecosystem (Jenkins Advisory).