CVE-2020-2290 - Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission

Back Back to CVE browser

MEDIUM

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission

Published Oct 8, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.90%

Description

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Affected products

Vendor Jenkins project Product Jenkins Active Choices Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 2.4

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Active Choices Plugin	unknown	Affected ≥ unspecified, ≤ 2.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://www.openwall.com/lists/oss-security/2020/10/08/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5188
Advisory
https://github.com/advisories/GHSA-rjch-j5x9-fgph
Advisory
https://github.com/jenkinsci/active-choices-plugin/commit/15e3e01929a687965f44d9d06cd2d870628a54dc
https://nvd.nist.gov/vuln/detail/CVE-2020-2290
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2008
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/10/08/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5188		Advisory
https://github.com/advisories/GHSA-rjch-j5x9-fgph		Advisory
https://github.com/jenkinsci/active-choices-plugin/commit/15e3e01929a687965f44d9d06cd2d870628a54dc
https://nvd.nist.gov/vuln/detail/CVE-2020-2290
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2008		x_refsource_CONFIRMVendor Advisory