CVE-2022-29039

Deeper analysis

The vulnerability is a stored cross-site scripting flaw (CWE-79) affecting the Jenkins Gerrit Trigger Plugin in versions 2.35.2 and earlier. It stems from a failure to escape the name and description fields of Base64 Encoded String parameters when those parameters are rendered on views, allowing untrusted content to be stored and later executed in other users' browsers.

Attackers who possess Item/Configure permission on a Jenkins item can supply crafted values in the affected parameter fields. Successful exploitation lets them run arbitrary scripts in the context of any user who later views the parameter display, with a CVSS 3.1 score of 5.4 reflecting the need for user interaction and the limited impact on confidentiality and integrity.

The Jenkins security advisory published on 2022-04-12 details the issue under SECURITY-2617 and directs administrators to update the Gerrit Trigger Plugin to a version that properly escapes the parameter metadata.

The EPSS probability for CVE-2022-29039 rose from a low baseline to a peak of 0.3160 on 2025-12-11 before receding to the current value of 0.0022, indicating a period of heightened exploitation interest after disclosure.