Описание
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting (XSS) vulnerability that may allow attackers to control job names.
Отчет
OpenShift 3.11 is already in the ELS support model phase. The Jenkins components are out of scope of the ELS support, therefore, the OpenShift 3.11 Jenkins component is marked as out of support scope in this CVE.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | jenkins-2-plugins | Out of support scope | ||
| OCP-Tools-4.12-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:3195 | 18.05.2023 |
| OCP-Tools-4.12-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:6172 | 30.10.2023 |
| OCP-Tools-4.12-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:0778 | 12.02.2024 |
| OCP-Tools-4.13-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:3299 | 24.05.2023 |
| OCP-Tools-4.13-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:6179 | 30.10.2023 |
| OCP-Tools-4.13-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:0776 | 12.02.2024 |
| OCP-Tools-4.14-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2023:7288 | 16.11.2023 |
| OCP-Tools-4.14-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:0777 | 12.02.2024 |
| OpenShift Developer Tools and Services for OCP 4.11 | jenkins-2-plugins | Fixed | RHSA-2023:3198 | 17.05.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
Cross-site Scripting in Jenkins Pipeline: Build Step Plugin
EPSS
5.4 Medium
CVSS3