GCVE - cpe:2.3:a:jenkins:jira_pipeline_steps:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:jira_pipeline_steps:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Jira Pipeline Steps (`d94ef5a8-a909-58af-92e8-bdc1da7b16c4`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/jira-steps-plugin`	purl2cpe	2026-06-01 10:14:10.744755

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-24440`	vulnerable	2026-06-08 05:56:05.463794	Details available Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T13:55:48.139Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24439`	vulnerable	2026-06-08 05:56:05.463375	Details available Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T13:56:41.158Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24438`	vulnerable	2026-06-08 05:56:05.462843	Details available A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T13:57:41.156Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2786	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24437`	vulnerable	2026-06-08 05:56:05.462393	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Published: 2023-01-24T00:00:00.000Z Updated: 2025-04-02T13:58:25.723Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2786	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.