PT-2018-5168 · Jenkins · Jenkins Active Choices Plugin+1

Daniel Beck · Published 2018-01-26 · Updated 2022-05-14 · CVE-2017-1000386

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Active Choices plugin versions 1.5.3 and earlier

Description The issue allows users with Job/Configure permission to insert arbitrary HTML, including JavaScript, into the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. To mitigate this, the Active Choices plugin now sanitizes the HTML if the script is executed in a sandbox. However, for unsandboxed scripts, which require administrator approval, it is the administrator's responsibility to manage potentially problematic script output.

Recommendations For Jenkins Active Choices plugin versions 1.5.3 and earlier, ensure that all scripts are executed in a sandbox to enable HTML sanitization. As a temporary workaround, consider restricting the use of the 'Active Choices Reactive Reference Parameter' type until a more permanent solution is applied. Administrators should carefully review and approve unsandboxed scripts to prevent the execution of arbitrary JavaScript.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-1000386

GHSA-C2HW-W9QM-Q5R9

Affected Products

Jenkins

Jenkins Active Choices Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000386 · Security Note
• https://jenkins.io/security/advisory/2017-10-23 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2hw-w9qm-q5r9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000386 · Vendor Advisory
• http://securityfocus.com/bid/101538 · Note