PT-2023-20286 · Jenkins · Jenkins Pipeline: Build Step Plugin+1

Kevin Guerroudj · Published 2023-02-15 · Updated 2025-03-19 · CVE-2023-25762

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Build Step Plugin versions 2.18 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because job names in a JavaScript expression used in the Pipeline Snippet Generator are not properly escaped. This allows attackers who can control job names to exploit the vulnerability.

Recommendations For Jenkins Pipeline: Build Step Plugin versions 2.18 and earlier, update to a version later than 2.18 to resolve the issue. As a temporary workaround, consider restricting the ability to control job names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25762

GHSA-9J65-3F2Q-8Q2R

RHSA-2023:1866

RHSA-2023:3195

RHSA-2023:3198

RHSA-2023:3299

RHSA-2023:6171

RHSA-2023:6172

RHSA-2023:6179

RHSA-2023:7288

RHSA-2024:0775

RHSA-2024:0776

RHSA-2024:0777

RHSA-2024:0778

Affected Products

Jenkins

Jenkins Pipeline: Build Step Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-25762 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25762 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9j65-3f2q-8q2r · Vendor Advisory
• https://jenkins.io/security/advisory/2023-02-15/#SECURITY-3019 · Vendor Advisory
• https://github.com/jenkinsci/pipeline-build-step-plugin/commit/0eaf88a695244ddb69d16c11b96659167dbead92 · Note
• https://github.com/jenkinsci/pipeline-build-step-plugin · Note
• https://t.me/cvenotify/115397 · Telegram Post
• https://t.me/cvenotify/44339 · Telegram Post
• https://t.me/cibsecurity/58227 · Telegram Post
• http://openwall.com/lists/oss-security/2023/02/15/4 · Note