Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jenkins-ci.plugins.workflow:workflow-job

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting

    CVE-2023-32977 · GHSA-2wvv-phhw-qvmc

    Affected
    • Maven org.jenkins-ci.plugins.workflow:workflow-job < 1295.v395eb
    Fixed in
    1295.v395eb· Vendor fix available
    Issue
    Jenkins Pipeline: Job Plugin 1292.v27d8cc3e2602 and earlier does not escape the display name of the build that caused an earlier build to be aborted, when "Do not allow concurrent builds" is set. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately. The Jenkins security team is not aware of any plugins that allow the exploitation of this vulnerability, as the build name must be set before the build starts. Pipeline: Job Plugin 1295.v395eb7400005 escapes the display name of the build that caused an earlier build to be aborted.

    Recommended action: Upgrade to 1295.v395eb or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →