CVE-2022-34172

Deeper analysis

The vulnerability is a cross-site scripting flaw, CVE-2022-34172, that affects Jenkins versions 2.340 through 2.355 inclusive. It occurs because symbol-based icons unescape previously escaped values supplied in tooltip parameters, allowing malicious script to execute in the context of other users.

An attacker with low privileges can exploit the issue over the network by supplying crafted tooltip content; successful exploitation requires user interaction by the victim and yields limited confidentiality and integrity impacts within a changed scope, consistent with the reported CVSS 5.4 rating.

The associated Jenkins security advisory published at the referenced URL details the issue under SECURITY-2781. The EPSS probability rose materially from a low baseline to a peak of 0.0640 on 2025-12-11 before receding to the current value of 0.0159, indicating a period of heightened exploitation interest after disclosure.