CVE-2022-30967

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins Selection tasks Plugin 1.0 and earlier. The plugin fails to escape the name and description fields of Script Selection task variable parameters when those parameters are rendered on views that display build parameters, allowing malicious script content to be stored and later executed in other users' browsers.

Attackers who possess Item/Configure permission on a Jenkins item can populate the affected parameter fields with crafted payloads. Once saved, the stored XSS executes in the context of any user who later views the parameter display, enabling the attacker to perform actions as that user within the Jenkins instance, such as modifying configuration or accessing sensitive data visible in the same origin.

The Jenkins security advisory published on 2022-05-17 identifies the issue under SECURITY-2717 and directs administrators to update the Selection tasks Plugin to a version that properly escapes the parameter metadata.

The EPSS score for this CVE rose sharply from a low baseline after disclosure to a peak of 0.3160 on 2025-12-11 before receding, indicating that exploitation interest increased well after the initial publication and that the vulnerability merits renewed attention.