jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin

A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and...

CVE-2023-32981

A flaw was found in the Jenkins Pipeline Utility Steps Plugin. This flaw allows a remote, authenticated attacker to traverse directories on the system, caused by improper archive file validation. The attacker can use a specially crafted archive file containing "dot dot" sequences /../ to create o...

CVE-2023-32977

A flaw was found in the Jenkins Pipeline: Job Plugin. Affected versions of Jenkins Pipeline: Job Plugin are vulnerable to Cross-site scripting caused by improper validation of user-supplied input. This flaw allows a remote authenticated attacker to inject malicious script into a Web page, which...

Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

Jenkins Pipeline Utility Steps Plugin provides the untar and unzip Pipeline steps to extract archives into job workspaces. Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives. This allows attackers able to provide crafted...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins:pipeline-editor (1.0-alpha-1) +1 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1.10)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.10 -...

GHSA-6987-XCCV-FHJP Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

Jenkins Pipeline Utility Steps Plugin provides the untar and unzip Pipeline steps to extract archives into job workspaces. Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives. This allows attackers able to provide crafted...

io.jenkins.blueocean:blueocean (1.2.0-beta-1), io.jenkins.blueocean:blueocean-events (1.2.0-beta-1) +10 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.11)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean 1.2.0-beta-1 -...

Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

Jenkins Pipeline: Job Plugin 1292.v27d8cc3e2602 and earlier does not escape the display name of the build that caused an earlier build to be aborted, when "Do not allow concurrent builds" is set. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set...

org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (>=1.0-alpha-1, <=1.0-alpha-2), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (>=1.0-alpha-1, <=1.0-alpha-2) +3 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1.14-beta-1)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1.14-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jenkins-ci.plugins.pipeline-stage-view:parent-pom =1.0-alpha-...

io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.27.4, <=1.27.5.1), io.jenkins.plugins:code-coverage-api (>=4.5.0, <=4.7.0) +2 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1282.ve6d865025906)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1282.ve6d865025906 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean-pipeline-scm-api =1.27.4,...

org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-api (2.32), org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view (2.32) potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (1284.v2fe8ed4573d4)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 1284.v2fe8ed4573d4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jenkins-ci.plugins.pipeline-stage-view:pipeline-rest-a...

org.jenkins-ci.plugins:pipeline-graph-analysis (1.6) potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.4)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - org.jenkins-ci.plugins:pipeline-graph-analysis 1.6 Source cves:...

GHSA-2WVV-PHHW-QVMC Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

Jenkins Pipeline: Job Plugin 1292.v27d8cc3e2602 and earlier does not escape the display name of the build that caused an earlier build to be aborted, when "Do not allow concurrent builds" is set. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set...

Jenkins HashiCorp Vault Plugin has improper masking of credentials

Jenkins HashiCorp Vault Plugin 360.v0a1c04cf807d and earlier does not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an...

io.jenkins.blueocean:blueocean-git-pipeline (>=1.2.0-beta-3, <=1.2.4), io.jenkins.blueocean:blueocean-pipeline-scm-api (>=1.2.0-beta-3, <=1.3.6) +1 more potentially affected by CVE-2023-32977 via org.jenkins-ci.plugins.workflow:workflow-job (2.11.1)

org.jenkins-ci.plugins.workflow:workflow-job MAVEN version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-job and may be impacted: - io.jenkins.blueocean:blueocean-git-pipeline =1.2.0-beta-3,...

GHSA-V3FV-V9M6-26G3 Jenkins HashiCorp Vault Plugin has improper masking of credentials

Jenkins HashiCorp Vault Plugin 360.v0a1c04cf807d and earlier does not properly mask i.e., replace with asterisks credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met: - The credentials are printed in build steps executing on an...

com.btc.ep:btc-embeddedplatform (>=2.5.8, <=2.5.9), org.jenkins-ci.plugins:qmetry-for-jira-test-management (>=1.11, <=1.27) potentially affected by CVE-2023-32981 via org.jenkins-ci.plugins:pipeline-utility-steps (1.1.1)

org.jenkins-ci.plugins:pipeline-utility-steps MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-utility-steps and may be impacted: - com.btc.ep:btc-embeddedplatform =2.5.8, =1.11, =1.27 Source cves:...

CVE-2023-32977

Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set build display names immediately...

CVE-2023-32981

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content...

CVE-2023-32977

Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to set build display names immediately...