Stored XSS vulnerability in Jenkins Active Choices Plugin

MEDIO 4.6CVE-2021-21616 · GHSA-4f6x-g5vh-8jm5 · Published 24/02/2021 · updated 17/06/2026

In breve

CVE-2021-21616 è una vulnerabilità MEDIO (CVSS 4.6) che riguarda org.biouno:uno-choice, active choices (jenkins).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 76.2%, superiore al 99.5% delle vulnerabilità.
Correzione: aggiornare a 2.5.3 o successiva.

Package	Affected versions	Patched versions
org.biouno:uno-choice Maven	`< 2.5.3`	`2.5.3`
active choices jenkins	`≤ 2.5.2`	No fix yet

Description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.3 escapes reference parameter values.

NVD description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2021-21616 · ADVISORY
jenkinsci/active-choices-plugin commit d0b768c · WEB
jenkinsci/active-choices-plugin · PACKAGE
jenkins.io/security/advisory/2021-02-24 · WEB
openwall.com/lists/oss-security/2021/02/24/3 · WEB

Altre vulnerabilità di org.biouno:uno-choice

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.biouno:uno-choice

Maven

< 2.5.3

2.5.3

active choices

jenkins

≤ 2.5.2

No fix yet

Description

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.3 escapes reference parameter values.

NVD description

Altre vulnerabilità di org.biouno:uno-choice

Vedi tutto →