CVE-2022-34185

Deeper analysis

The Jenkins Date Parameter Plugin 0.0.4 and earlier is affected by a stored cross-site scripting vulnerability tracked as CVE-2022-34185. The root cause is missing output escaping for the name and description fields of Date parameters when those parameters are rendered on views, which maps to CWE-79 and carries a CVSS 3.1 score of 5.4.

An attacker who already possesses Item/Configure permission on a Jenkins item can supply a malicious payload in a Date parameter's name or description. When another user subsequently views the parameter configuration, the payload executes in the victim's browser context, enabling limited confidentiality and integrity impacts within the Jenkins instance.

The official Jenkins security advisory published on 2022-06-22 details the issue under SECURITY-2784 and is the authoritative source for mitigation steps. Exploitation probability, as measured by EPSS, rose from lower values at disclosure to a peak of 0.2585 in December 2025 before receding to the current 0.1390, indicating a clear post-disclosure increase in observed exploitation interest.