GCVE - cpe:2.3:a:jenkins:active_choices:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:active_choices:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Active Choices (`c2e8f5f9-26bf-5d43-b3cc-111cb971db8d`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-21699`	vulnerable	2026-06-08 05:29:13.138705	Details available Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Published: 2021-11-12T10:35:15.000Z Updated: 2024-08-03T18:23:29.538Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2219 http://www.openwall.com/lists/oss-security/2021/11/12/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21616`	vulnerable	2026-06-08 05:29:13.029388	Details available Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Published: 2021-02-24T15:05:27.000Z Updated: 2024-08-03T18:16:23.647Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-02-24/#SECURITY-2192 http://www.openwall.com/lists/oss-security/2021/02/24/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2290`	vulnerable	2026-06-08 05:24:59.231059	Details available Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Published: 2020-10-08T12:40:26.000Z Updated: 2024-08-04T07:01:41.185Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2008 http://www.openwall.com/lists/oss-security/2020/10/08/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-2289`	vulnerable	2026-06-08 05:24:59.230475	Details available Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Published: 2020-10-08T12:40:26.000Z Updated: 2024-08-04T07:01:41.291Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1954 http://www.openwall.com/lists/oss-security/2020/10/08/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-1000386`	vulnerable	2026-06-08 05:08:34.476633	Details available Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output. Published: 2018-01-26T02:00:00.000Z Updated: 2024-08-05T22:00:41.109Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2017-10-23/ http://www.securityfocus.com/bid/101538	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.