Jenkins Pipeline: Build Step vulnerabilities

3 CVEs affecting Jenkins Pipeline: Build Step, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25762, published 2023-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-25762, published 2023-02-15. Medium severity, CVSS 5.4. EPSS: 81.4% chance of exploitation in the next 30 days. Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS)…
CVE-2017-1000089, published 2017-10-05. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the…
CVE-2022-25184, published 2022-02-15. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with…