Jenkins Scriptler vulnerabilities

5 CVEs affecting Jenkins Scriptler, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50765, published 2023-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21668, published 2021-06-16. Medium severity, CVSS 5.4. EPSS: 76% chance of exploitation in the next 30 days. Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
CVE-2021-21667, published 2021-06-16. Medium severity, CVSS 5.4. EPSS: 75.7% chance of exploitation in the next 30 days. Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…
CVE-2023-50764, published 2023-12-13. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary…
CVE-2021-21700, published 2021-11-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting (XSS) vulnerability…
CVE-2023-50765, published 2023-12-13. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID.