Jenkins Active Choices vulnerabilities

5 CVEs affecting Jenkins Active Choices, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-21699, published 2021-11-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21699, published 2021-11-12. Medium severity, CVSS 5.4. EPSS: 88.5% chance of exploitation in the next 30 days. Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS)…
CVE-2021-21616, published 2021-02-24. Medium severity, CVSS 4.6. EPSS: 76.2% chance of exploitation in the next 30 days. Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure…
CVE-2020-2289, published 2020-10-08. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers…
CVE-2020-2290, published 2020-10-08. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability…
CVE-2017-1000386, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active…