Patchfirst
Patchfirst
CVE-2023-25762 Medium · 5.4 EPSS 82.1%

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the…

Jenkins Project · Jenkins Pipeline: Build Step Plugin

Summary

The Jenkins Pipeline: Build Step Plugin (version 2.18 and earlier) fails to escape job names within a JavaScript expression in the Pipeline Snippet Generator, creating a stored cross-site scripting flaw. An attacker who can control job names can plant script that executes in the browser of a user who views the affected page, and this requires the attacker to hold the ability to name jobs (low privileges) and a user to interact with the page.

Official description · CVE.org

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Breakdown
23.7 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 15 Feb 2023. No public exploit code or confirmed exploitation is recorded.

2 related vulnerabilities in the same code over 12 months. The latest fix listed for pipeline-build-step is 2.18.1.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2022-25184Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals…15 Feb 2022
  2. relatedHigh

    Why these are linked:

    • Fixed one release later2.15.1 → 2.18.1 (org.jenkins-ci.plugins:pipeline-build-step)
    • Same code patched: BuildTriggerStep.java (machine-matched)commit c06f654commit 0eaf88a
    • Similar weakness in the same product (machine-matched)same product + description similarity
    This CVECVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not…15 Feb 2023

Fixes in pipeline-build-stepMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 1.0.5CVE-2020-211812 Feb 2020
  2. 2.5.1CVE-2017-10000894 Oct 2017
  3. 2.15.1CVE-2022-2518415 Feb 2022
  4. 2.18.1CVE-2023-2576215 Feb 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:pipeline-build-step.

Mavenorg.jenkins-ci.plugins:pipeline-build-stepGHSA-9j65-3f2q-8q2r

Upgrade to 2.18.1 or later

Set the version to 2.18.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2023-25762. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 2.18.12.18.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

Other 1

jenkins.io/security/advisory/2023-02-15/#SECURITY-3019

mailing-list 1

openwall.com/lists/oss-security/2023/02/15/4
↑ ↓ chooseEnter openEsc close