CVE-2022-34196

Deeper analysis

Jenkins REST List Parameter Plugin 1.5.2 and earlier is affected by a stored cross-site scripting vulnerability. The plugin fails to escape the name and description fields of REST list parameters when those parameters are rendered on views, allowing malicious content to be stored and later executed in users' browsers. The issue is tracked as CWE-79 and carries a CVSS 3.1 score of 5.4.

Attackers who possess Item/Configure permission on a Jenkins item can supply crafted parameter names or descriptions that are persisted and served to other users viewing the parameter page. Successful exploitation can result in limited impacts to confidentiality and integrity within the Jenkins context, consistent with the reflected scope change noted in the CVSS vector.

The Jenkins security advisory published on 2022-06-22 details the flaw and is available at the referenced URL for operators seeking remediation guidance. The associated EPSS score rose from a low baseline to a peak of 0.3160 on 2025-12-11 before receding to its current value of 0.0999, indicating a period of increased exploitation interest after disclosure.