High severity8.8NVD Advisory· Published May 16, 2023· Updated Jun 17, 2026

CVE-2023-32981

Description

An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:pipeline-utility-stepsMaven	< 2.15.3	2.15.3

Affected products

Jenkins Project/Pipeline Utility Steps
cpe:2.3:a:jenkins:pipeline_utility_steps:*:*:*:*:*:jenkins:*:*
Range: <=2.15.2
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/pipeline-utility-steps
Range: < 2.15.3
Jenkins Project/Jenkins Jira Pipeline Steps Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-6987-xccv-fhjpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-32981ghsaADVISORY
www.jenkins.io/security/advisory/2023-05-16/nvdVendor AdvisoryWEB
github.com/jenkinsci/pipeline-utility-steps-plugin/commit/0ba4f329ee27c023609653e25bdd5604c5e46a11ghsaWEB

News mentions

Jenkins Security Advisory 2023-05-16
Jenkins Security Advisories · May 16, 2023

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000