Skip to content
Sign in
5.4 Medium

CVE-2023-25762 Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…

Description

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Affected products and versions

Product Affected versions Fixed in
Jenkins Pipeline: Build Step Plugin 2.18 earliest → 2.18 No fix stated

Other CVEs of Jenkins Pipeline: Build Step Plugin

The 4 CVEs of Jenkins Pipeline: Build Step Plugin →
CVE-2026-84661 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream… 5.4 Medium CVE-2026-84660 A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream… 5.4 Medium CVE-2022-25184 Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a… Not rated
Track this CVE