CVE-2020-2290: Stored XSS vulnerability in Jenkins Active Choices Plugin
Summary
CVE-2020-2290: Stored XSS vulnerability in Jenkins Active Choices Plugin. Affects org.biouno:uno-choice versions < 2.5. Fixed in 2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Active Choices Plugin is a tool that allows users to create dynamic and interactive parameters in Jenkins jobs. It provides functionality to define parameters that can be populated dynamically based on the user's input or other factors. The plugin is widely used in Jenkins environments to enhance job configuration and customization.
Vulnerability Detail
The Active Choices Plugin version 2.4 and earlier is affected by a stored cross-site scripting (XSS) vulnerability. This vulnerability arises due to the plugin's failure to properly escape List and Map return values of sandboxed scripts for Reactive Reference Parameter. Attackers with Job/Configure permission can exploit this vulnerability to inject malicious scripts, leading to potential XSS attacks. This vulnerability is a result of an incomplete fix for a previous security issue (SECURITY-470). The issue has been addressed in Active Choices Plugin version 2.5, which now properly escapes all legal return values of sandboxed scripts.
How To Fix
Minimum fixed version
2.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround can be implemented. This involves restricting Job/Configure permission to trusted users only. By limiting access to this permission, the risk of exploitation can be minimized. However, this workaround should be considered temporary, and upgrading to the latest version of the plugin is still the recommended solution.
Conclusion
The Active Choices Plugin in Jenkins versions 2.4 and earlier is vulnerable to stored XSS attacks. Upgrading to version 2.5 or later is the recommended solution to address this vulnerability. Restricting Job/Configure permission to trusted users can provide temporary mitigation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.biouno:uno-choice →
FAQ
The vulnerability allows attackers with Job/Configure permission to inject malicious scripts, potentially leading to cross-site scripting attacks. This can result in unauthorized access, data theft, or other malicious activities.
Users of Active Choices Plugin versions 2.4 and earlier are affected by this vulnerability. Jenkins instances that have the plugin installed and allow Job/Configure permission to untrusted users are at risk.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address the vulnerability to prevent potential exploitation.
The recommended mitigation is to upgrade the Active Choices Plugin to version 2.5 or later. Restricting Job/Configure permission to trusted users can also reduce the risk of exploitation, but it is not a permanent solution.
Yes, the CVSS score for this vulnerability is 8.0, indicating a high severity level. The score is based on the following metrics: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Related vulnerabilities
Recent vulnerabilities recorded for org.biouno:uno-choice.
