Not rated
CVE-2020-2290 Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive…
Description
Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Active Choices Plugin 2.4 | earliest → 2.4 | No fix stated |
Other CVEs of Jenkins Active Choices Plugin
The 4 CVEs of Jenkins Active Choices Plugin →
CVE-2021-21699
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…
Not rated
CVE-2021-21616
Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…
Not rated
CVE-2020-2289
Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in…
Not rated