Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.

Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-21603
• https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889
• jenkinsci/jenkins@f5d9842