Description
Jenkins Active Choices 插件中存在存储型XSS漏洞。此漏洞是由于响应式参数和动态引用参数的参数名称验证不足导致的。
Jenkins Active Choices Plugin CVE-2021-21699 存储型XSS漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.wangan.com/p/7fygf367ba2f2acc
https://cve.imfht.com/detail/CVE-2020-2290
https://www.modb.pro/db/171741
https://bbs.antiy.cn/thread-96195-1-1.html
https://github.com/advisories/GHSA-rp4x-h577-chvq
https://www.jenkins.io/security/advisory/2021-11-12/
https://nvd.nist.gov/vuln/detail/CVE-2021-21699
https://feedly.com/cve/CVE-2021-21699
https://scanrepeat.com/vulnerability-database/active-choices-cross-site-scripting
https://advisories.gitlab.com/pkg/maven/org.biouno/uno-choice/
https://stack.watch/product/jenkins/active-choices/
https://www.openwall.com/lists/oss-security/2021/11/12/1
https://docs.devguard.org/vulnerability-database/CVE-2021-21699/
https://www.cve.org/CVERecord?id=CVE-2021-21699