Stored XSS vulnerability in Jenkins Active Choices Plugin

MEDIUM 4.6CVE-2021-21616 · GHSA-4f6x-g5vh-8jm5 · Published 24/02/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.biouno:uno-choice Maven	`< 2.5.3`	`2.5.3`
active choices jenkins	`≤ 2.5.2`	No fix yet

Description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.3 escapes reference parameter values.

NVD description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21616 · ADVISORY
jenkinsci/active-choices-plugin commit d0b768c · WEB
jenkinsci/active-choices-plugin · PACKAGE
jenkins.io/security/advisory/2021-02-24 · WEB
openwall.com/lists/oss-security/2021/02/24/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free