CVE-2022-30961

Deeper analysis

Jenkins Autocomplete Parameter Plugin 1.1 and earlier contains a stored cross-site scripting vulnerability because it fails to escape the names of Dropdown Autocomplete and Auto Complete String parameters when rendering parameter views. The affected component is the Jenkins Autocomplete Parameter Plugin, which integrates with Jenkins to provide dynamic parameter completion on job configuration pages.

Attackers who possess Item/Configure permission on a Jenkins instance can supply a malicious parameter name that is stored and later executed in the browser of any user who views the affected job's parameter page. Successful exploitation allows the attacker to run arbitrary JavaScript in the context of other users' sessions, enabling actions such as credential theft or configuration changes within the scope permitted by the victim's permissions.

The Jenkins security advisory published on 2022-05-17 identifies the issue as SECURITY-2717 and recommends that administrators update the Autocomplete Parameter Plugin to a version that properly escapes parameter names.

The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.3160 on 2025-12-11 before receding to its current value of 0.0022, indicating a period of increased exploitation interest that warrants renewed attention.