CVE-2022-34784
Published: 30 June 2022
Summary
CVE-2022-34784 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Jenkins Build-Metrics. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 7.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a stored cross-site scripting flaw (CWE-79) in the Jenkins build-metrics Plugin version 1.3. It stems from missing output escaping of the build description on one of the plugin's views and carries a CVSS 3.1 score of 5.4.
Attackers who possess Build or Update permission can inject malicious scripts that are later rendered for other users, enabling theft of credentials or session tokens within the Jenkins instance.
The Jenkins project published an advisory on 30 June 2022 that details the issue under SECURITY-1118 and points administrators to the corresponding plugin update.
EPSS for the CVE rose from low values to a peak of 0.1820 on 11 December 2025 before receding to the current 0.0863, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6357
Vulnerability details
Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.