CVE-2023-25762
Published: 15 February 2023
Summary
CVE-2023-25762 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Pipeline\. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Jenkins Pipeline: Build Step Plugin 2.18 and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape job names when they are inserted into a JavaScript expression inside the Pipeline Snippet Generator. The affected component is the Jenkins Pipeline: Build Step Plugin, and the flaw is tracked as CWE-79 with a CVSS 3.1 score of 5.4.
Attackers who can create or modify Jenkins job names are able to inject arbitrary script into the Snippet Generator page. Successful exploitation results in stored XSS that executes in the context of other users who view the generated snippet, allowing limited impacts on confidentiality and integrity while requiring user interaction and producing a scope change.
The Jenkins security advisory published on 2023-02-15 and the corresponding oss-security mailing list posting provide the official notification and remediation guidance for this issue. The EPSS score has remained flat at its peak value of 0.6532 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0679
Vulnerability details
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.