Vulnerabilities > Jenkins > Pipeline

DATE CVE VULNERABILITY TITLE RISK
2023-05-16 CVE-2023-32977 Cross-site Scripting vulnerability in Jenkins Pipeline: JOB
Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.
network
low complexity
jenkins CWE-79
5.4
2023-02-15 CVE-2023-25762 Cross-site Scripting vulnerability in Jenkins Pipeline: Build Step
Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
network
low complexity
jenkins CWE-79
5.4
2022-10-19 CVE-2022-43402 Unspecified vulnerability in Jenkins Pipeline: Groovy
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
network
low complexity
jenkins
critical
9.9
2022-10-19 CVE-2022-43407 Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Pipeline: Input Step
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is not correctly encoded, allowing attackers able to configure Pipelines to have Jenkins build URLs from 'input' step IDs that would bypass the CSRF protection of any target URL in Jenkins when the 'input' step is interacted with.
network
low complexity
jenkins CWE-352
8.8
2022-10-19 CVE-2022-43408 Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Pipeline:Stage View
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.
network
low complexity
jenkins CWE-352
6.5
2022-10-19 CVE-2022-43409 Cross-site Scripting vulnerability in Jenkins Pipeline: Supporting Apis 838.Va3A087B4055B
Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
network
low complexity
jenkins CWE-79
5.4
2022-06-23 CVE-2022-34177 Path Traversal vulnerability in Jenkins Pipeline: Input Step
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
network
low complexity
jenkins CWE-22
7.5
2022-05-17 CVE-2022-30945 Unspecified vulnerability in Jenkins Pipeline: Groovy
Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.
network
high complexity
jenkins
8.5
2022-04-12 CVE-2022-29047 Incorrect Authorization vulnerability in Jenkins Pipeline: Shared Groovy Libraries
Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.
network
low complexity
jenkins CWE-863
5.3
2022-03-29 CVE-2022-28155 XXE vulnerability in Jenkins Pipeline: Phoenix Autotest
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
network
low complexity
jenkins CWE-611
8.1