CVE-2023-25762

CVE-2023-25762 affects Jenkins Pipeline: Build Step Plugin 2.18 and earlier. The root cause is failure to escape job names in a JavaScript expression used by the Pipeline Snippet Generator, enabling a stored XSS vulnerability exploitable by attackers who can control job names. The provided docume...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.9 Multiple Vulnerabilities (CloudBees Security Advisory 2023-02-15)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.9. It is, therefore, affected by multiple vulnerabilities including the following: - CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow...

Jenkins Build Step Plugin fails to check Item/Build permission

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...

GHSA-8JX9-7J5M-79X4 Jenkins Build Step Plugin fails to check Item/Build permission

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...

GHSA-G84F-CMC8-682C Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs...

Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs...

CVE-2022-25184

Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs...

CVE-2022-25184

CVE-2022-25184 affects Jenkins Pipeline: Build Step Plugin (versions 2.15 and earlier). The vulnerability allows attackers with Item/Read permission to retrieve the default value of password parameters by generating a pipeline script with the Pipeline Snippet Generator, exposing secrets from jobs...

PT-2022-17124 · Jenkins · Jenkins Pipeline: Build Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Build Step Plugin versions 2.15 and earlier Description: The issue allows attackers with Item/Read permission to retrieve the default password parameter value from jobs when generating a pipeline script using the Pipeline...

CVE-2017-1000089

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...

CVE-2017-1000089

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...