CVE-2022-30956

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins Rundeck Plugin versions 3.6.10 and earlier. It stems from a lack of URL scheme restrictions when processing Rundeck webhook submissions, allowing malicious payloads to be stored and later rendered in Jenkins user interfaces.

Attackers with the ability to submit crafted Rundeck webhook payloads can exploit the issue to inject and execute arbitrary scripts in the context of other users who view the affected Jenkins pages. Successful exploitation can lead to theft of credentials or session tokens and other actions within the Jenkins instance, though the CVSS vector requires some user interaction and limits impact to confidentiality and integrity without affecting availability.

The official Jenkins security advisory recommends upgrading the Rundeck Plugin to a version that enforces proper URL scheme validation for webhook data. Administrators are advised to apply the fix promptly and review any existing webhook configurations for signs of tampering.

The EPSS score for this CVE rose materially from a low baseline to a peak of 0.1406 before receding, indicating a period of increased exploitation interest well after initial disclosure. No evidence of widespread in-the-wild attacks is noted in the provided references.