Every CVE Search/ Get API key

CVE-2023-32981

Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

8.8 HighFix available

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.02%Up 1.0 points since May 17, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Record
CVE-2023-32981
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
CVE List 8.8

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Record
CVE-2023-32981
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2023-1480 8.8

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Record
EUVD-2023-1480
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-6987-xccv-fhjp 6.3

Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

Jenkins Pipeline Utility Steps Plugin provides the untar and unzip Pipeline steps to extract archives into job workspaces.

Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.

This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in tar and zip archives that would be placed outside the expected destination directory.

Record
GHSA-6987-xccv-fhjp
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-787
Updated
2026-11-02
OSVGHSA-6987-xccv-fhjp 6.3

Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability

Jenkins Pipeline Utility Steps Plugin provides the untar and unzip Pipeline steps to extract archives into job workspaces.

Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.

This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in tar and zip archives that would be placed outside the expected destination directory.

Record
GHSA-6987-xccv-fhjp
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-787
Updated
2026-11-02
OSVRHSA-2023:3610 9.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2023:3610
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3625 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.10.62 security update

Record
RHSA-2023:3625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3663 8.8

Red Hat Security Advisory: jenkins and jenkins-2-plugins security update

Record
RHSA-2023:3663
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:pipeline-utility-steps
Maven
 before 2.15.3
2.15.3
org.jenkins-ci.plugins:pipeline-utility-steps
Maven
 before 2.15.3, plus listed versions
1.01.11.1.11.1.21.1.3
Show 39 moreShow less
1.1.41.1.51.1.61.2.01.2.11.2.21.3.01.4.01.4.11.5.01.5.12.02.0.12.0.22.1.02.10.02.11.02.12.02.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.15.1.12.15.22.2.02.3.02.3.12.4.02.5.02.6.02.6.12.7.02.7.12.8.02.9.0
2.15.3
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 13 CVEs
 before 0:2.401.1.1686649641-3.el8
0:2.401.1.1686649641-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 13 CVEs
 before 0:4.12.1686649756-1.el8
0:4.12.1686649756-1.el8
jenkins
Red Hat:openshift:4.10::el8
From an advisory covering 6 CVEs
 before 0:2.401.1.1685677065-1.el8
0:2.401.1.1685677065-1.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 6 CVEs
 before 0:4.10.1685679861-1.el8
0:4.10.1685679861-1.el8
jenkins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 17 CVEs
 before 0:2.401.1.1686831596-3.el8
0:2.401.1.1686831596-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.11::el8
From an advisory covering 17 CVEs
 before 0:4.11.1686831822-1.el8
0:4.11.1686831822-1.el8

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-32981 is a high vulnerability (CVSS 8.8) in Jenkins Pipeline Utility Steps, published May 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in org.jenkins-ci.plugins:pipeline-utility-steps 2.15.3.

References

Show 122 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open