Stored Cross-Site Scripting in Jenkins Pipeline Job Plugin

CVE-2023-32977

Summary

The Jenkins Pipeline Job Plugin is susceptible to a stored cross-site scripting vulnerability due to improper escaping of the display name for builds. This flaw could allow malicious users, capable of setting build display names, to execute arbitrary JavaScript code in the context of other users' browsers. As a result, sensitive data could be compromised, and user sessions hijacked without the need for direct user interaction. It is crucial to update to the patched version to mitigate this security risk.

References