CVE-2022-29043

Deeper analysis

Jenkins Mask Passwords Plugin 3.0 and earlier contains a stored cross-site scripting vulnerability because it fails to escape the name and description fields of Non-Stored Password parameters when those parameters are rendered on views that display build parameters. The affected component is the Jenkins plugin that masks passwords in job configurations.

Attackers who possess Item/Configure permission on a Jenkins item can supply malicious payloads in the parameter name or description fields. When another user subsequently views the parameter list, the attacker-supplied script executes in the context of that user’s session, enabling theft of credentials or other actions within the Jenkins instance.

The Jenkins security advisory published on 2022-04-12 identifies the issue as SECURITY-2617 and states that users should update the Mask Passwords Plugin to a version that properly escapes the relevant fields.

The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.3160 on 2025-12-11 before receding to the current value of 0.0022, indicating a period of increased exploitation interest that later subsided.