CVE-2022-34184

Deeper analysis

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier is affected by a stored cross-site scripting vulnerability tracked as CVE-2022-34184. The plugin fails to escape the name and description fields of CRX Content Package Choice parameters when rendering parameter views, allowing malicious script content to be stored and later executed in victims' browsers. The issue is classified under CWE-79 with a CVSS 3.1 score of 5.4.

Attackers who possess Item/Configure permission on a Jenkins instance can supply crafted parameter values that persist in the job configuration. When other users subsequently view the affected parameter pages, the injected scripts execute in their session context, enabling theft of sensitive data or actions within the Jenkins application under the victim's privileges.

The Jenkins security advisory published on 2022-06-22 details the flaw and directs administrators to update the CRX Content Package Deployer Plugin to a version that properly escapes parameter content. No other specific workarounds are described in the reference.

EPSS for this CVE rose from lower values after disclosure to a peak of 0.3160 on 2025-12-11 before receding to the current 0.0999, indicating that exploitation interest increased well after the initial publication.