Vulnerability Details CVE-2020-2290
Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.4%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
Products affected by CVE-2020-2290
-
cpe:2.3:a:jenkins:active_choices:0.1
-
cpe:2.3:a:jenkins:active_choices:0.10
-
cpe:2.3:a:jenkins:active_choices:0.11
-
cpe:2.3:a:jenkins:active_choices:0.12
-
cpe:2.3:a:jenkins:active_choices:0.13
-
cpe:2.3:a:jenkins:active_choices:0.14
-
cpe:2.3:a:jenkins:active_choices:0.15
-
cpe:2.3:a:jenkins:active_choices:0.16
-
cpe:2.3:a:jenkins:active_choices:0.17
-
cpe:2.3:a:jenkins:active_choices:0.18
-
cpe:2.3:a:jenkins:active_choices:0.19
-
cpe:2.3:a:jenkins:active_choices:0.2
-
cpe:2.3:a:jenkins:active_choices:0.20
-
cpe:2.3:a:jenkins:active_choices:0.21
-
cpe:2.3:a:jenkins:active_choices:0.24
-
cpe:2.3:a:jenkins:active_choices:0.3
-
cpe:2.3:a:jenkins:active_choices:0.4
-
cpe:2.3:a:jenkins:active_choices:0.5
-
cpe:2.3:a:jenkins:active_choices:0.6
-
cpe:2.3:a:jenkins:active_choices:0.7
-
cpe:2.3:a:jenkins:active_choices:0.8
-
cpe:2.3:a:jenkins:active_choices:0.9
-
cpe:2.3:a:jenkins:active_choices:1.0
-
cpe:2.3:a:jenkins:active_choices:1.1
-
cpe:2.3:a:jenkins:active_choices:1.2
-
cpe:2.3:a:jenkins:active_choices:1.3
-
cpe:2.3:a:jenkins:active_choices:1.4
-
cpe:2.3:a:jenkins:active_choices:1.5
-
cpe:2.3:a:jenkins:active_choices:1.5.0
-
cpe:2.3:a:jenkins:active_choices:1.5.1
-
cpe:2.3:a:jenkins:active_choices:1.5.2
-
cpe:2.3:a:jenkins:active_choices:1.5.3
-
cpe:2.3:a:jenkins:active_choices:2.0
-
cpe:2.3:a:jenkins:active_choices:2.1
-
cpe:2.3:a:jenkins:active_choices:2.3
-
cpe:2.3:a:jenkins:active_choices:2.4