CVE-2022-34188

Deeper analysis

Jenkins Hidden Parameter Plugin 0.0.4 and earlier contains a stored cross-site scripting vulnerability because it fails to escape the name and description fields of Hidden Parameter parameters when they are rendered on views that display build parameters. The affected component is the Jenkins plugin that provides this parameter type for pipeline and job configurations.

Attackers who possess Item/Configure permission on a Jenkins item can supply malicious payloads in the parameter name or description. When another user subsequently views the parameter configuration or build page, the script executes in the victim's browser context, enabling actions such as credential theft or unauthorized configuration changes within the Jenkins instance.

The Jenkins security advisory published on 2022-06-22 for SECURITY-2784 addresses the issue and directs administrators to update the Hidden Parameter Plugin to a fixed release that properly escapes the affected fields.

EPSS for this CVE rose from a low baseline to a peak of 0.2585 on 2025-12-11 before receding to the current value of 0.0611, indicating a period of increased exploitation interest well after initial disclosure.