{"id":"CVE-2021-21699","published":"2021-11-12T10:35:15Z","modified":"2024-08-03T18:23:29Z","title":"Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic…","vendor":"Jenkins project","product":"Jenkins Active Choices Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Active Choices Plugin","versions":[">= unspecified, <= 2.5.6"]}],"description":{"text":"Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins Active Choices Plugin, versions 2.5.6 and earlier, fails to escape the parameter names of its reactive and dynamic reference parameters, which leaves the plugin's parameter handling open to injection. An attacker holding Job/Configure permission can exploit this to plant a stored cross-site scripting payload that executes in the browsers of other users who view the affected job.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:14Z"},"cvss":null,"epss":{"score":0.88476,"percentile":0.9977,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2219","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2021/11/12/1","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.biouno:uno-choice","vulnerableRanges":["<2.5.7"],"patched":["2.5.7"],"from":["GHSA-rp4x-h577-chvq"],"provenance":"source"}],"advisories":[{"id":"GHSA-rp4x-h577-chvq","url":"https://github.com/advisories/GHSA-rp4x-h577-chvq","severity":"MODERATE","ecosystem":"Maven","package":"org.biouno:uno-choice","vulnerableRanges":["<2.5.7"],"patched":["2.5.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5204","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5204","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-11-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-21699","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":20.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9977"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-2289","published":"2020-10-08","fixed":"2.5","kev":false},{"cve":"CVE-2020-2290","published":"2020-10-08","fixed":"2.5","kev":false},{"cve":"CVE-2021-21616","published":"2021-02-24","fixed":"2.5.3","kev":false,"link":{"from":"CVE-2021-21616","to":"CVE-2021-21699","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.biouno:uno-choice","fromFixed":"2.5.3","toFixed":"2.5.7","daysApart":261},{"kind":"similar","provenance":"machine","score":0.79,"basis":"same product + description similarity"}]}},{"cve":"CVE-2021-21699","published":"2021-11-12","fixed":"2.5.7","kev":false}],"package":"Maven:org.biouno:uno-choice"}}