Loading HuntDB...

GHSA-rjch-j5x9-fgph

GitHub Security Advisory

Stored XSS vulnerability in Jenkins Active Choices Plugin

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

Jenkins Active Choices Plugin 2.4 and earlier does not escape `List` and `Map` return values of sandboxed scripts for Reactive Reference Parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

This issue is caused by an incomplete fix for [SECURITY-470](https://www.jenkins.io/security/advisory/2017-10-23/#persisted-cross-site-scripting-vulnerability-in-active-choices-plugin).

Active Choices Plugin 2.5 escapes all legal return values of sandboxed scripts.

Affected Packages

Maven org.biouno:uno-choice
Affected versions: 0 (fixed in 2.5)

Related CVEs

Key Information

GHSA ID
GHSA-rjch-j5x9-fgph
Published
May 24, 2022 5:30 PM
Last Modified
October 27, 2023 11:38 AM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.biouno:uno-choice
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.