CVE-2023-25762

CVE-2023-25762 affects Jenkins Pipeline: Build Step Plugin 2.18 and earlier. The root cause is failure to escape job names in a JavaScript expression used by the Pipeline Snippet Generator, enabling a stored XSS vulnerability exploitable by attackers who can control job names. The provided docume...

CVE-2023-25762

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control job names...

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.9 Multiple Vulnerabilities (CloudBees Security Advisory 2023-02-15)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.9. It is, therefore, affected by multiple vulnerabilities including the following: - CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow...

plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin

Jenkins Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier allows attackers with Job/Configure permission to access credentials with attacker-specified IDs stored in the private per-user credentials stores of any attacker-specified user in Jenkins...

jenkins-plugin/workflow-support: Stored XSS vulnerability in Pipeline: Supporting APIs Plugin

A Cross-site scripting XSS vulnerability was found in a Jenkins plugin. This issue may allow an authenticated remote attacker to create Pipelines...

jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin

A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and...

jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin

A Cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections...

jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin

A sandbox bypass vulnerability was found in several Jenkins plugins. This could allow an authenticated attacker to execute arbitrary code within the Jenkins JVM controller. Exploitation could be achieved by crafting untrusted libraries or pipelines, compromising the integrity, availability, and...

jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin

A cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an unauthenticated attacker to access Jenkins builds, bypassing CSRF protections. This could compromise the integrity, availability, and confidentiality of Jenkins...

jenkins-plugin/pipeline-utility-steps: Arbitrary file read vulnerability in Pipeline Utility Steps Plugin

A flaw was found in the Pipeline Utility Steps Jenkins Plugin. The affected version of the Pipeline Utility Steps Plugin does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default. This flaw allows attackers...

CVE-2022-45588

All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity XXE type of attacks. Users should download the R2022-09 release or later and use it in place of the previous version. Talend Remote Engine Gen 1 and Talend Cloud Engine for Design are no...

org.jenkins-ci.plugins:extreme-notification (>=1.5, <=1.6), org.jenkins-ci.plugins:junit-realtime-test-reporter (>=0.5, <=0.6) +1 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.33)

org.jenkins-ci.plugins:script-security MAVEN version 1.33 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:extreme-notification =1.5, =0.5, =3.4.0-beta-1, =3.5.12 Sourc...

com.arkea.satd:xlrelease-var-setter (>=0.2, <=0.4), io.jenkins.blueocean:blueocean (>=1.0.0-b02, <=1.0.0-b12) +3 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.22)

org.jenkins-ci.plugins:script-security MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - com.arkea.satd:xlrelease-var-setter =0.2, =1.0.0-b02, =1.2.1, =2.0, =0.1, =0.5 Sourc...

io.fabric8.pipeline:kubernetes-pipeline-aggregator (1.3), io.fabric8.pipeline:kubernetes-pipeline-core (1.3) +6 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.14)

org.jenkins-ci.plugins:script-security MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 -...

hudson.plugins.octopusdeploy:octopusdeploy (4.0.2), org.jenkins-ci.plugins:badge (>=1.0, <=1.1) +2 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.39)

org.jenkins-ci.plugins:script-security MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - hudson.plugins.octopusdeploy:octopusdeploy 4.0.2 - org.jenkins-ci.plugins:badge =1.0...

de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.40)

org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2023-24422 Source...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

org.jenkins-ci.plugins.workflow:workflow-cps (>=2.40, <=2.41), org.jenkins-ci.plugins:claim (>=2.10, <=2.15) +3 more potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.34)

org.jenkins-ci.plugins:script-security MAVEN version 1.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-cps =2.40, =2.10, =1.7, =1.2.5, =1.2.5,...

Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin

A cross-site request forgery CSRF vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...