CVE-2022-29038

Deeper analysis

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape the name and description fields of Extended Choice parameters when rendering parameter views. The affected component is the Jenkins plugin that supplies these parameter types for build jobs.

Attackers holding Item/Configure permission can supply malicious content in the parameter name or description, which is then persisted and executed in the browsers of other users who later view the parameter configuration. The CVSS 5.4 vector reflects network access, low attack complexity, and required user interaction, with impacts limited to limited confidentiality and integrity loss in a changed scope.

The Jenkins security advisory published on 2022-04-12 at https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617 documents the issue. Exploitation probability rose sharply from a low baseline to a peak of 0.2958 before receding to the current value of 0.0039, indicating that interest in the vulnerability increased after disclosure.