CVE-2022-30970

Deeper analysis

Jenkins Autocomplete Parameter Plugin 1.1 and earlier is affected by a stored cross-site scripting vulnerability tracked as CVE-2022-30970. The plugin references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, allowing malicious script to be persisted and later executed in other users' browsers. The issue carries a CVSS 3.1 score of 5.4 and is classified under CWE-79.

Attackers who possess Item/Configure permission on a Jenkins instance can exploit the flaw by supplying crafted parameter names that are stored in job configurations. When other users subsequently view the affected job pages, the injected script executes in their context with the potential to read limited data or perform actions on their behalf within the Jenkins application.

The Jenkins security advisory published on 2022-05-17 recommends that administrators update the Autocomplete Parameter Plugin to a version that resolves SECURITY-2267 and, where immediate patching is not feasible, restrict Item/Configure permissions to trusted users as a temporary control.

The associated EPSS score rose sharply from a low baseline to a peak of 0.3160 on 2025-12-11 before receding, indicating that meaningful exploitation interest developed well after the original disclosure.