Stored XSS vulnerability in Jenkins Active Choices Plugin

MEDIO 4.6CVE-2021-21616 · GHSA-4f6x-g5vh-8jm5 · Published 24/02/2021 · updated 17/06/2026

En resumen

CVE-2021-21616 es una vulnerabilidad MEDIO (CVSS 4.6) que afecta a org.biouno:uno-choice, active choices (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 76.2%, mayor que el 99.5% de las vulnerabilidades.
Solución: actualizar a 2.5.3 o posterior.

Package	Affected versions	Patched versions
org.biouno:uno-choice Maven	`< 2.5.3`	`2.5.3`
active choices jenkins	`≤ 2.5.2`	No fix yet

Description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.3 escapes reference parameter values.

NVD description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21616 · ADVISORY
jenkinsci/active-choices-plugin commit d0b768c · WEB
jenkinsci/active-choices-plugin · PACKAGE
jenkins.io/security/advisory/2021-02-24 · WEB
openwall.com/lists/oss-security/2021/02/24/3 · WEB

Más vulnerabilidades de org.biouno:uno-choice

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.biouno:uno-choice

Maven

< 2.5.3

2.5.3

active choices

jenkins

≤ 2.5.2

No fix yet

Description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.3 escapes reference parameter values.

NVD description

Más vulnerabilidades de org.biouno:uno-choice

Ver todo →