CVE-2023-25762: XSS
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting (XSS) vulnerability that may allow attackers to control job names.
Other sources
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-25762?
CVE-2023-25762 is a vulnerability in Jenkins Pipeline Build Step Plugin, which allows for stored cross-site scripting (XSS) attacks.
How severe is CVE-2023-25762?
CVE-2023-25762 has a severity rating of 5.4 (medium).
Which versions of Jenkins Pipeline Build Step Plugin are affected by CVE-2023-25762?
CVE-2023-25762 affects versions up to 2.18.1 of Jenkins Pipeline Build Step Plugin.
How can I fix CVE-2023-25762?
To fix CVE-2023-25762, you should upgrade to version 2.18.1 or higher of Jenkins Pipeline Build Step Plugin.
Where can I find more information about CVE-2023-25762?
You can find more information about CVE-2023-25762 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2023-25762), NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2023-25762), and Jenkins Security Advisory (https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019).