CVE-2020-2289

CVE-2020-2289 affects Jenkins with the Active Choices Plugin (versions 2.4 and earlier). The root cause is that the name and description of build parameters are not escaped, leading to a stored cross-site scripting (XSS) vulnerability. The impact is that an attacker with Job/Configure permission ...

CVE-2017-1000386

The CVE-2017-1000386 entry relates to the Jenkins Active Choices plugin (versions 1.5.3 and earlier). The vulnerability arises because a user with Job/Configure permission could provide arbitrary HTML in the Active Choices Reactive Reference Parameter, which could render on the Build With Paramet...

CVE-2021-21616

The CVE-2021-21616 issue affects Jenkins Active Choices Plugin (versions 2.5.2 and earlier). The root cause is failure to escape reference parameter values, resulting in a stored XSS vulnerability exploitable by users with Job/Configure permission. The vulnerability is evidenced across multiple r...

CVE-2020-2290

CVE-2020-2290 affects Jenkins Active Choices Plugin 2.4 and earlier. The vulnerability arises because some return values of sandboxed scripts for Reactive Reference Parameters (notably List and Map) are not escaped, enabling stored XSS. Exploitation requires Job/Configure permission. The issue is...

CVE-2021-21699

Summary: CVE-2021-21699 affects Jenkins with the Active Choices Plugin. Versions 2.5.6 and earlier do not escape the parameter name of reactive and dynamic reference parameters, causing a stored XSS vulnerability. Exploitation is possible by attackers with Job/Configure permission. Impact (as sta...