CVE-2022-25185

Deeper analysis

The vulnerability is a stored cross-site scripting flaw (CWE-79) in the Jenkins Generic Webhook Trigger Plugin versions 1.81 and earlier. It stems from the plugin failing to escape the build cause string supplied via webhook payloads, allowing malicious markup to be persisted and later rendered in the Jenkins UI. The issue carries a CVSS 3.1 score of 5.4 and affects any Jenkins instance using the plugin to process incoming webhooks.

Attackers who possess Item/Configure permission on a job can craft webhook requests that embed executable script in the build cause. When other users subsequently view the job's build history or related pages, the stored payload executes in their browsers with the context of the Jenkins application, enabling theft of session tokens or other actions within the reflected security scope.

The Jenkins security advisory published on 2022-02-15 and the accompanying Openwall disclosure recommend upgrading the Generic Webhook Trigger Plugin to a version that properly escapes the build cause field. Administrators are advised to apply the fix promptly and to review jobs that accept untrusted webhook input.

EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.1230 on 2025-12-11 before receding to the current value of 0.0021, indicating a period of increased exploitation interest that later subsided.