CVE-2021-21699

Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a…

published November 12, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
88%
Percentile
99.8
In the wild
Unconfirmed
What it is

Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.88476 · 99.8th percentile
Published
2021-11-12T10:35Z
EPSS history
Timeline
  • 12 NOV 10:35Z
    Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a…
    cvelistv5