CVE-2022-30965

Deeper analysis

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape the name and description fields of Promotion Level parameters when rendering views that display those parameters. The affected component is a Jenkins plugin used to manage build promotion workflows within the Jenkins continuous integration system.

Attackers who possess Item/Configure permission on a Jenkins instance can supply malicious payloads in the Promotion Level parameter fields. Once saved, these payloads execute in the browsers of other users who view the affected parameter pages, enabling theft of session tokens, redirection to attacker-controlled sites, or other actions within the Jenkins web interface.

The Jenkins security advisory published on 2022-05-17 identifies the issue as SECURITY-2717 and recommends that administrators update the Promoted Builds (Simple) Plugin to a version that properly escapes the parameter content.

The EPSS score for this CVE rose from a low baseline to a peak of 0.3160 on 2025-12-11 before receding, indicating that exploitation interest increased substantially after the initial disclosure.