GHSA-9jv5-wf44-8vfm

Stored XSS vulnerability in Jenkins Active Choices Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2289

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.biouno:uno-choice	< 2.5	2.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Active Choices Plugin 2.5 escapes the name of build parameters and applies the configured markup formatter to the description of build parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2289 advisory
https://github.com/jenkinsci/active-choices-plugin/commit/59bbd4a963dbf1aba5ca9699a913b06d4b5182fe web
https://github.com/jenkinsci/active-choices-plugin package
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1954 web
http://www.openwall.com/lists/oss-security/2020/10/08/5 web