Extensible Choice Parameter
Monthly
Cross-site request forgery in the Jenkins Extensible Choice Parameter Plugin (239.v5f5c278708cf and earlier) allows an attacker to lure an authenticated Jenkins user with an active session into submitting a crafted request that causes the plugin to execute sandboxed Groovy code, producing limited integrity and availability impact while leaving confidentiality unaffected (CVSS 5.4). The CVSS vector shows the attacker needs no privileges of their own (PR:N) but the attack only succeeds with victim interaction (UI:R), so it cannot be carried out directly. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (CISA KEV), and EPSS is low at 0.26% (16th percentile), consistent with a moderate-priority issue rather than a top-tier one.
Cross-site request forgery in the Jenkins Extensible Choice Parameter Plugin (239.v5f5c278708cf and earlier) allows an attacker to lure an authenticated Jenkins user with an active session into submitting a crafted request that causes the plugin to execute sandboxed Groovy code, producing limited integrity and availability impact while leaving confidentiality unaffected (CVSS 5.4). The CVSS vector shows the attacker needs no privileges of their own (PR:N) but the attack only succeeds with victim interaction (UI:R), so it cannot be carried out directly. No public exploit code has been identified at time of analysis, the issue is not confirmed actively exploited (CISA KEV), and EPSS is low at 0.26% (16th percentile), consistent with a moderate-priority issue rather than a top-tier one.