CVE-2022-30962

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins Global Variable String Parameter Plugin version 1.2 and earlier. The plugin fails to escape the name and description fields of Global Variable String parameters when rendering parameter views, allowing malicious script content to be stored and later executed in other users' browsers.

Attackers who possess Item/Configure permission on a Jenkins item can supply crafted parameter names or descriptions that are persisted and served to other users viewing the same configuration or build pages. Successful exploitation can result in execution of arbitrary script in the context of another user's session, enabling actions such as credential theft or configuration changes within the scope permitted by the victim's permissions.

The Jenkins security advisory published on 2022-05-17 details the issue under SECURITY-2717 and recommends that administrators update the Global Variable String Parameter Plugin to a version that properly escapes these fields.

The EPSS score for this CVE rose materially from a low baseline to a peak of 0.2585 on 2025-12-11 before receding to the current value of 0.0022, indicating a period of increased exploitation interest well after initial disclosure.