Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1ycDR4LWg1NzctY2h2cc4AAqqb

Stored XSS vulnerability in Jenkins Active Choices Plugin

Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Active Choices Plugin 2.5.7 escapes references to parameter names.

Permalink: https://github.com/advisories/GHSA-rp4x-h577-chvq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycDR4LWg1NzctY2h2cc4AAqqb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-rp4x-h577-chvq, CVE-2021-21699
References:

Affected Version Ranges: <= 2.5.6
Fixed in: 2.5.7