Jenkins Active Choices — known CVE vulnerabilities

Every CVE whose affected-product data names Jenkins Active Choices, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2017-1000386 — CVSS 5.4 (medium): Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown…
• CVE-2020-2289 — CVSS 5.4 (medium): Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in a stored…
• CVE-2020-2290 — CVSS 5.4 (medium): Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Reference Parameters…
• CVE-2021-21699 — CVSS 5.4 (medium): Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters…
• CVE-2021-21616 — CVSS 4.6 (medium): Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting…