CVE-2023-25762: 
Java vulnerability analysis and mitigation

Jenkins Pipeline: Build Step Plugin version 2.18 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2023-25762) discovered in February 2023. The vulnerability affects the Pipeline Snippet Generator component where job names are not properly escaped in JavaScript expressions (Jenkins Advisory, CVE Mitre).

The vulnerability is rated as High severity and stems from improper escaping of job names in JavaScript expressions within the Pipeline Snippet Generator. This security flaw exists in Pipeline: Build Step Plugin versions up to and including 2.18. The issue was fixed in version 2.18.1 by implementing proper escaping of job names in the affected JavaScript expression (Jenkins Advisory).

The vulnerability allows attackers who have the ability to control job names to execute stored cross-site scripting (XSS) attacks. This could potentially lead to unauthorized access, data theft, or manipulation of Jenkins configurations through the execution of malicious JavaScript code in the context of other users' browsers (Jenkins Advisory).

Users should upgrade to Pipeline: Build Step Plugin version 2.18.1 or later, which includes the fix for this vulnerability. The fix implements proper escaping of job names in the affected JavaScript expression within the Pipeline Snippet Generator (Jenkins Advisory).