| Package | Affected versions | Patched versions |
|---|---|---|
| org.biouno:uno-choice | < 2.5 | 2.5 |
| active choices | ≤ 2.4 |
Jenkins Active Choices Plugin 2.4 and earlier does not escape List and Map return values of sandboxed scripts for Reactive Reference Parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
This issue is caused by an incomplete fix for SECURITY-470.
Active Choices Plugin 2.5 escapes all legal return values of sandboxed scripts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free