Stored XSS vulnerability in Jenkins Git Plugin

published 2021-10-06 5 y ago modified 2026-06-17 4 mo ago also GHSA-gghc-g8cj-4vfv , EUVD-2022-3953

cvss: 6.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

Patch / fix

fixed in 2 distros 1 links 1

maven org.jenkins-ci.plugins:git 4.8.3
Jenkins project Jenkins Git Plugin 4.3.1, 4.7.1.1

cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
jenkins openshift 4.10 2.319.2.1643288987-1.el8
openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055

github.com/jenkinsci/git-plugin@5474cc9 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21684 updated 2026-08-04 cvss 6.1

jenkins-2-plugins/git: stored XSS vulnerability

Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1643404185-1.el8
fixed: vendor fix RHSA-2022:0055
Red Hat Fuse 7 jenkins Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +164 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.jenkins-ci.plugins:git	<4.8.3	4.8.3

Affected products

Jenkins project Jenkins Git Plugin

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output
CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /jenkinsci/git-plugin/commit/5474cc942bfba60927be629ff47fb41c38c66741
web
jenkins.io /security/advisory/2021-10-06/#SECURITY-2499
web, vendor-advisory
openwall.com /lists/oss-security/2021/10/06/1
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-21684
advisory
github.com /jenkinsci/git-plugin
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary