CVE-2022-25189

Deeper analysis

The vulnerability is a stored cross-site scripting flaw (CWE-79) in the Jenkins Custom Checkbox Parameter Plugin version 1.1 and earlier. The plugin fails to escape parameter names supplied for custom checkbox parameters, allowing malicious markup to be persisted and later rendered in the Jenkins UI. The issue carries a CVSS 3.1 base score of 5.4 and affects any Jenkins instance using the vulnerable plugin.

Attackers who possess Item/Configure permission can create or modify a job that uses a custom checkbox parameter whose name contains executable script. Once saved, the payload is stored and executed in the browsers of other users who view the job configuration or related pages, enabling theft of credentials, session hijacking, or other actions within the Jenkins context.

The official Jenkins security advisory published on 2022-02-15 (SECURITY-2266) documents the flaw and directs administrators to update the Custom Checkbox Parameter Plugin to a corrected release that properly escapes parameter names.

EPSS for the CVE rose from a low baseline to a peak of 0.0507 on 2025-12-11 before receding to the current value of 0.0024, indicating a period of increased exploitation interest after disclosure.