[org.jenkins-ci.plugins:extra-columns] Stored XSS vulnerability in Jenkins Extra Columns Plugin

Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build parameters column, or the attacker also needs View/Configure permission.

Extra Columns Plugin 1.23 escapes parameter values in the build parameters column.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-21630
• https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2222
• http://www.openwall.com/lists/oss-security/2021/03/30/1
• https://github.com/advisories/GHSA-wx66-pm7r-2q82