CVE-2020-2289: XSS
Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Other sources
Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Active Choices Plugin 2.5 escapes the name of build parameters and applies the configured markup formatter to the description of build parameters.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-2289?
CVE-2020-2289 is a vulnerability in Jenkins Active Choices Plugin 2.4 and earlier that allows stored cross-site scripting (XSS) attacks.
What is the severity of CVE-2020-2289?
The severity of CVE-2020-2289 is medium with a CVSS score of 5.4.
How does CVE-2020-2289 affect Jenkins Active Choices Plugin?
CVE-2020-2289 affects Jenkins Active Choices Plugin 2.4 and earlier versions by not properly escaping the name and description of build parameters, allowing for potential XSS attacks.
How can CVE-2020-2289 be exploited?
CVE-2020-2289 can be exploited by attackers with Job/Configure permission who can inject malicious code through the unescaped build parameter names and descriptions.
Is there a fix available for CVE-2020-2289?
Yes, Active Choices Plugin 2.5 has been released, which addresses the vulnerability by properly escaping the name of build parameters.