Read the docs
TI-2023-11034 Aliases CVE-2023-25762GHSA-9j65-3f2q-8q2r

Cross-site scripting in Jenkins Pipeline: Build Step Plugin

Priority HIGH 65CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.82131 99th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:pipeline-build-step (Maven): 2.18.1Red Hat: 12 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Pipeline: Build Step Pluginup to 2.18—No fix listedCNA
—org.jenkins-ci.plugins:pipeline-build-step (Maven)before 2.18.12.18.1Patch availableGHSA-9j65-3f2q-8q2r
  • Jenkins Pipeline: Build Step Plugin VendorJenkins Affected up to 2.18 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:pipeline-build-step (Maven) Vendor— Affected before 2.18.1 Fixed in 2.18.1 Patch available GHSA-9j65-3f2q-8q2r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:pipeline\:_build_step:*:*:*:*:*:jenkins:*:*_build_stepVulnerableJenkins
  • cpe:2.3:a:jenkins:pipeline\:_build_step:*:*:*:*:*:jenkins:*:* Versions _build_step Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-9j65-3f2q-8q2r org.jenkins-ci.plugins:pipeline-build-step (Maven) Fixed in 2.18.1 Advisory →

Red Hat 12 advisories

  • RHSA-2024:0775 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1706516946-1.el8, jenkins-2.426.3.1706516929-3.el8
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8
Show 9 more Red Hat advisories
  • RHSA-2024:0776 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1706516346-1.el8, jenkins-2.426.3.1706516254-3.el8
  • RHSA-2023:7288 Released 2023-11-16 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1699356715-1.el8, jenkins-2.414.3.1699356615-3.el8
  • RHSA-2023:6179 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1698292274-1.el8, jenkins-2.414.3.1698292201-3.el8
  • RHSA-2023:6172 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1698294000-1.el8, jenkins-2.414.3.1698293911-3.el8
  • RHSA-2023:6171 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.11 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1698299029-1.el8, jenkins-2.414.3.1698298955-3.el8
  • RHSA-2023:3299 Released 2023-05-24 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1684911916-1.el8, jenkins-2.387.3.1684911776-3.el8
  • RHSA-2023:3195 Released 2023-05-18 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1683009955-1.el8, jenkins-2.387.1.1683009767-3.el8
  • RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Critical
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
  • RHSA-2023:1866 Released 2023-04-26 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.58 security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1681719745-1.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3198, RHSA-2023:6171, RHSA-2024:0775
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:3195, RHSA-2023:6172, RHSA-2024:0778
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2023:3299, RHSA-2023:6179, RHSA-2024:0776
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2023:7288, RHSA-2024:0777
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:1866
Not affected: 5 products
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Developer Tools and Services for OCP 4.13
  • OpenShift Developer Tools and Services for OCP 4.14
  • Red Hat OpenShift Container Platform 4.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25762
  2. 2026-10-03 Alias added: GHSA-9j65-3f2q-8q2r

References

Advisory 3

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15846 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… CVSS 3.1HIGH 8.8
  • TI-2019-15847 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier… CVSS 3.1HIGH 8.8
  • TI-2019-15886 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-21197 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin CVSS 3.1CRITICAL 9.9
  • TI-2022-08895 Protection mechanism failure in Jenkins Pipeline: Shared Groovy Libraries Plugin CVSS 3.1HIGH 8.8
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences