CVE-2021-21699 — Cross-site Scripting in Project Jenkins Active Choices Plugin

CWE-79 — Cross-site ScriptingCWE-250 — Execution with Unnecessary PrivilegesCWE-269 — Improper Privilege ManagementCWE-279 — Incorrect Execution-Assigned Permissions6 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.2%
top 52.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Active Choices PluginJenkins Active Choices
Timeline
PublishedNov 12
Latest updateMay 24

Description

Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_active_choices_pluginunspecified — 2.5.6

🔴Vulnerability Details

4
OSV
Stored XSS vulnerability in Jenkins Active Choices Plugin↗2022-05-24
▶
GHSA
Stored XSS vulnerability in Jenkins Active Choices Plugin↗2022-05-24
▶
GHSA
Execution with Unnecessary Privileges in ipython↗2022-01-21
▶
CVEList
CVE-2021-21699: Jenkins Active Choices Plugin 2↗2021-11-12
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2021-11-12↗2021-11-12
▶
CVE-2021-21699 — Cross-site Scripting | cvebase