CVE-2022-29040

Deeper analysis

Jenkins Git Parameter Plugin 0.9.15 and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape the name and description fields of Git parameters when rendering parameter views. The affected component is the Jenkins Git Parameter Plugin, which is used to define parameterized builds that accept Git-related inputs.

Attackers who possess Item/Configure permission on a Jenkins job can supply malicious payloads in the parameter name or description fields. When other users subsequently view the job configuration or build parameters, the injected script executes in their browsers, enabling actions such as theft of session tokens or manipulation of build settings within the Jenkins instance.

The Jenkins security advisory published on 2022-04-12 details the issue under SECURITY-2617 and directs administrators to upgrade the Git Parameter Plugin to a version that properly escapes these fields.

The EPSS score for this CVE rose sharply from a low baseline to a peak of 0.3160 on 2025-12-11 before receding to the current value of 0.0022, indicating a period of increased exploitation interest well after initial disclosure.