CVE-2022-29045

Deeper analysis

The vulnerability is a stored cross-site scripting flaw (CWE-79) affecting the Jenkins promoted builds Plugin in versions 873.v6149db_d64130 and earlier, excluding 3.10.1. The plugin fails to escape the name and description fields of Promoted Build parameters when rendering views that display those parameters, allowing malicious markup to be persisted and later executed in users' browsers.

Attackers who possess Item/Configure permission on a Jenkins item can supply crafted parameter names or descriptions that are stored and served to other users viewing the affected pages. Successful exploitation yields the ability to run arbitrary script in the context of another user's session, with a CVSS 3.1 score of 5.4 reflecting network attack vector, low attack complexity, and limited impact on confidentiality and integrity.

The Jenkins security advisory for SECURITY-2617, published on 2022-04-12, identifies the issue and points to version 3.10.1 as the corrected release that restores proper escaping of the parameter fields.

EPSS for this CVE rose from a low baseline after disclosure to a peak of 0.2585 on 2025-12-11 before receding to the current value of 0.0022, indicating a period of increased exploitation interest that later subsided.