CVE-2022-30968

Deeper analysis

The vulnerability is a stored cross-site scripting flaw in the Jenkins vboxwrapper Plugin versions 1.3 and earlier. The plugin fails to escape the name and description fields of VBox node parameters when those values are rendered on parameter-display views, allowing malicious script to be stored and later executed in other users' browsers. The issue is tracked as CWE-79 and carries a CVSS 3.1 score of 5.4.

Attackers who possess Item/Configure permission on a Jenkins job can supply a crafted parameter name or description containing executable script. When another user subsequently views the affected configuration page, the script executes in that user's context with the privileges of the viewing account, enabling theft of credentials, session hijacking, or other actions within the Jenkins instance.

The official Jenkins security advisory published on 17 May 2022 recommends upgrading the vboxwrapper Plugin to a fixed release that properly escapes the parameter fields. Administrators are advised to apply the update promptly and to audit existing jobs for suspicious parameter content.

EPSS for this CVE rose sharply from a low baseline to a peak of 0.3160 on 11 December 2025 before receding, indicating a period of materially increased exploitation interest well after initial disclosure.