description: Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
affected:
{
product: Jenkins Pipeline: Build Step Plugin
vendor: Jenkins Project
versions:
lessThanOrEqual: 2.18, status: affected, version: unspecified, versionType: custom
}