CVE-2017-1000386 Cross-site Scripting in Jenkins Active Choices plugin

What is CVE-2017-1000386?

CVE-2017-1000386 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Jan 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output.

Weakness: CWE-79

Which versions are affected by CVE-2017-1000386?

2 open source packages ship an affected version, including org.biouno:uno-choice. It affects 1 product.

Products include Jenkins Active Choices.

How do I fix CVE-2017-1000386?

Upgrade org.biouno:uno-choice to 2.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-1000386 being exploited?

There is no known exploitation of CVE-2017-1000386 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-21699 Stored XSS vulnerability in Jenkins Active Choices Plugin Medium 5.4
• CVE-2020-2289 Stored XSS vulnerability in Jenkins Active Choices Plugin Medium 5.4
• CVE-2020-2290 Stored XSS vulnerability in Jenkins Active Choices Plugin Medium 5.4
• CVE-2021-21616 Stored XSS vulnerability in Jenkins Active Choices Plugin Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c2hw-w9qm-q5r9.