What is GHSA-rjch-j5x9-fgph?

GHSA-rjch-j5x9-fgph is a security advisory published by GitHub Security Advisories with Medium severity. Stored XSS vulnerability in Jenkins Active Choices Plugin

Which CVE IDs does GHSA-rjch-j5x9-fgph cover?

GHSA-rjch-j5x9-fgph covers the following CVE IDs: CVE-2020-2290. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rjch-j5x9-fgph?

GHSA-rjch-j5x9-fgph has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-rjch-j5x9-fgph?

GHSA-rjch-j5x9-fgph affects 1 product, including: maven/org.biouno:uno-choice:\u003c 2.5.

GHSA-rjch-j5x9-fgphMediumCVSS 5.4

Stored XSS vulnerability in Jenkins Active Choices Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 22, 2023

🔗 CVE IDs covered (1)

CVE-2020-2290 →

📋 Description

Jenkins Active Choices Plugin 2.4 and earlier does not escape List and Map return values of sandboxed scripts for Reactive Reference Parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

This issue is caused by an incomplete fix for SECURITY-470.

Active Choices Plugin 2.5 escapes all legal return values of sandboxed scripts.

🎯 Affected products1

maven/org.biouno:uno-choice:< 2.5

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-2290
https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-2008
http://www.openwall.com/lists/oss-security/2020/10/08/5
https://github.com/jenkinsci/active-choices-plugin/commit/15e3e01929a687965f44d9d06cd2d870628a54dc
https://github.com/advisories/GHSA-rjch-j5x9-fgph