{"id":"CVE-2021-22510","aliases":[],"url":"https://o3.security/vulnerability/CVE-2021-22510","summary":"Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin","details":"Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape user input in a form validation response.\n\nThis results in a reflected cross-site scripting (XSS) vulnerability.\n\nMicro Focus Application Automation Tools Plugin 6.8 escapes user input in the affected form validation response.\n\nA security hardening since Jenkins 2.275 and LTS 2.263.2 prevents exploitation of this vulnerability.","published":"2022-05-24T17:46:58Z","modified":"2024-02-16T08:23:48.765233Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.04977,"percentile":0.91779,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.jenkins-ci.plugins:hp-application-automation-tools-plugin","fixedVersion":"6.8"}],"fix":{"url":"https://github.com/jenkinsci/hpe-application-automation-tools-plugin/commit/9fbd698401048644c325751e290f6d901128c1c7","label":"jenkinsci/hpe-application-automation-tools-plugin@9fbd698"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22510"},{"type":"WEB","url":"https://github.com/jenkinsci/hpe-application-automation-tools-plugin/commit/9fbd698401048644c325751e290f6d901128c1c7"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/hpe-application-automation-tools-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-2175"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-02-16T08:23:48.765233Z"}}