PT-2023-24110 · Jenkins · Jenkins Pipeline: Job Plugin+1

Kevin Guerroudj · Published 2023-05-16 · Updated 2025-01-23 · CVE-2023-32977

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Job Plugin versions 1292.v27d8cc3e2602 and earlier

Description The Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability. This issue is exploitable by attackers able to set build display names immediately. The vulnerability occurs when the "Do not allow concurrent builds" option is set. It is noted that the build name must be set before the build starts, and the Jenkins security team is not aware of any plugins that allow the exploitation of this vulnerability.

Recommendations For Jenkins Pipeline: Job Plugin versions 1292.v27d8cc3e2602 and earlier, update to version 1295.v395eb 7400005 or later, which escapes the display name of the build that caused an earlier build to be aborted, thereby resolving the stored cross-site scripting (XSS) vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-32977

GHSA-2WVV-PHHW-QVMC

RHSA-2023:3610

RHSA-2023:3625

RHSA-2023:3663

Affected Products

Jenkins

Jenkins Pipeline: Job Plugin

References · 8

• https://osv.dev/vulnerability/GHSA-2wvv-phhw-qvmc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32977 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32977 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-05-16/#SECURITY-3042 · Vendor Advisory
• https://github.com/jenkinsci/workflow-job-plugin/commit/395eb740000509bff789c7f409c90f2a4a738821 · Note
• https://t.me/cibsecurity/64238 · Telegram Post
• https://t.me/cvenotify/108367 · Telegram Post
• https://t.me/cvenotify/50563 · Telegram Post