Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-32977

Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerabilit

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jenkins

Description

Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Jenkins Project Jenkins Pipeline: Job Plugin

Default version status: affected

  • 1295.v395eb_7400005 to < *unaffected
  • 1289.1291.vb_7c188e7e7df to < 1289.*unaffected
  • 1207.1209.v69351208a_5a_7 to < 1207.*unaffected

References