CVE-2022-34178
Published: 23 June 2022
Summary
CVE-2022-34178 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Embeddable Build Status. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 11.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Jenkins Embeddable Build Status Plugin 2.0.3 is affected by a reflected cross-site scripting vulnerability arising from unrestricted values accepted in the 'link' query parameter that controls the destination of build status badges.
An unauthenticated remote attacker can supply a crafted parameter value in a URL that is then rendered for another user, executing arbitrary script in the context of the Jenkins instance and achieving limited confidentiality and integrity impacts consistent with the CVSS 6.1 rating.
The Jenkins security advisory covering SECURITY-2567 details the issue and its resolution. The associated EPSS score rose from a low baseline to a peak of 0.1613 on 2025-12-11 before receding to the current value of 0.0424, indicating measurable post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-5901
Vulnerability details
Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.