Jenkins project · Jenkins Active Choices Plugin
The Jenkins Active Choices Plugin, versions 2.5.6 and earlier, fails to escape the parameter names of its reactive and dynamic reference parameters, which leaves the plugin's parameter handling open to injection. An attacker holding Job/Configure permission can exploit this to plant a stored cross-site scripting payload that executes in the browsers of other users who view the affected job.
Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Disclosed on 12 Nov 2021. No public exploit code or confirmed exploitation is recorded.
4 fixes in uno-choice over 13 months. The latest fix listed for uno-choice is 2.5.7.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.biouno:uno-choice.
Upgrade to 2.5.7 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-21616).
Set the version to 2.5.7 or later in your pom.xml or build.gradle.
The first fix for CVE-2021-21699.
| If you run | Upgrade to |
|---|---|
| All versions before 2.5.7 | 2.5.7 |
“Up to” means the second version is the fix and is not affected.