jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin

🗓️ 12 Feb 2024 10:27:23Reported by RedHatType

Stored cross-site scripting in the Pipeline Build Step Plugin allows control of job names via an unescaped JavaScript expression.

Reporter	Title	Published	Views	Family All 61
Circl	CVE-2023-25762	15 Feb 202316:36	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.9 Multiple Vulnerabilities (CloudBees Security Advisory 2023-02-15)	15 Feb 202300:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.10.58 (RHSA-2023:1866)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3195)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3198)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3299)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Product OCP Tools 4.11 Openshift Jenkins (RHSA-2023:6171)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Product OCP Tools 4.12 Openshift Jenkins (RHSA-2023:6172)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2023:6179)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Red Hat Product OCP Tools 4.14 Openshift Jenkins (RHSA-2023:7288)	23 Apr 202400:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	any	jenkins-2-plugins	0:4.14.1706516441-1.el8.noarch	jenkins-2-plugins-0:4.14.1706516441-1.el8.noarch.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-25762
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-25762
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2023-02-15/

08 Jul 2026 05:44Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.4

EPSS0.814

SSVC