Not rated
CVE-2021-21699 Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…
Description
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Active Choices Plugin 2.5 | earliest → 2.5.6 | No fix stated |
Other CVEs of Jenkins Active Choices Plugin
The 4 CVEs of Jenkins Active Choices Plugin →
CVE-2021-21616
Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored…
Not rated
CVE-2020-2289
Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in…
Not rated
CVE-2020-2290
Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive…
Not rated