CVE-2023-25762

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Build Step Plugin versions 2.18 and earlier

Description The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because job names in a JavaScript expression used in the Pipeline Snippet Generator are not properly escaped. This allows attackers who can control job names to exploit the vulnerability.

Recommendations For Jenkins Pipeline: Build Step Plugin versions 2.18 and earlier, update to a version later than 2.18 to resolve the issue. As a temporary workaround, consider restricting the ability to control job names to minimize the risk of exploitation.