CVE-2022-27207

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins global-build-stats Plugin versions 1.5 and earlier. Multiple fields in the chart configuration on the Global Build Stats page are not properly escaped, allowing malicious input to be persisted and later rendered in other users' browsers.

Attackers with Overall/Administer permission can exploit the issue by supplying crafted values in the affected configuration fields. Successful exploitation enables the attacker to execute arbitrary scripts in the context of other users who view the Global Build Stats page, potentially leading to limited confidentiality and integrity impacts within the Jenkins instance.

The Jenkins security advisory published on 2022-03-15 details the flaw under SECURITY-1886 and recommends that administrators update the global-build-stats Plugin to a version that properly escapes the configuration fields. Corresponding Openwall announcements reiterate the same upgrade guidance for affected Jenkins installations.

EPSS for the CVE rose from a low baseline to a peak of 0.0605 on 2025-12-11 before receding to the current value of 0.0021, indicating a period of increased exploitation interest well after initial disclosure.