CVE-2022-34194
Published: 23 June 2022
Summary
CVE-2022-34194 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Readonly Parameter. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Jenkins Readonly Parameter Plugin 1.0.0 and earlier contains a stored cross-site scripting vulnerability because it fails to escape the name and description fields of Readonly String and Readonly Text parameters when those parameters are rendered on views. The affected component is the Jenkins Readonly Parameter Plugin, which is used to define non-editable build parameters within Jenkins jobs.
Attackers who possess Item/Configure permission can supply malicious content in the parameter name or description fields. When other users subsequently view the parameter configuration pages, the injected script executes in their browsers, enabling theft of session tokens or other actions within the Jenkins context.
The Jenkins security advisory published at https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2784 documents the issue under SECURITY-2784 and provides the official notification for administrators.
The EPSS score remains flat at its peak value of 0.2958 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6035
Vulnerability details
Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.