CVE-2020-2290: XSS
Jenkins Active Choices Plugin 2.4 and earlier does not escape List and Map return values of sandboxed scripts for Reactive Reference Parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
This issue is caused by an incomplete fix for SECURITY-470.
Active Choices Plugin 2.5 escapes all legal return values of sandboxed scripts.
Other sources
Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2290?
CVE-2020-2290 is classified as a medium severity vulnerability.
How do I fix CVE-2020-2290?
To fix CVE-2020-2290, update the Jenkins Active Choices Plugin to version 2.5 or later.
Who is impacted by CVE-2020-2290?
CVE-2020-2290 affects users of Jenkins with Job/Configure permission using Active Choices Plugin versions 2.4 and earlier.
What type of vulnerability is CVE-2020-2290?
CVE-2020-2290 is a stored cross-site scripting (XSS) vulnerability.
What causes the vulnerability CVE-2020-2290?
CVE-2020-2290 is caused by the failure to escape `List` and `Map` return values in sandboxed scripts for Reactive Reference Parameters.