CVE-2022-34198

Deeper analysis

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape the name and description fields of Stash Branch parameters when those parameters are rendered on views that display build parameters. The affected component is the Jenkins Stash Branch Parameter Plugin running inside Jenkins instances that expose parameter configuration pages to users.

Attackers who possess Item/Configure permission can supply malicious JavaScript payloads in the parameter name or description fields; when another user subsequently views the affected parameter page, the script executes in that user's browser context with the privileges of the Jenkins application, enabling theft of session tokens, modification of build configurations, or other actions within the same origin.

The Jenkins security advisory published on 2022-06-22 recommends that administrators update the Stash Branch Parameter Plugin to a version that properly escapes parameter metadata and, where immediate updates are not feasible, restrict Item/Configure access to trusted users only.

The EPSS score for this CVE rose from a low baseline to a peak of 0.3160 on 2025-12-11 before receding to the current value of 0.0999, indicating a measurable increase in observed exploitation interest well after initial disclosure.