CVE-2022-34786

Deeper analysis

Jenkins Rich Text Publisher Plugin 1.4 and earlier contains a stored cross-site scripting vulnerability because the plugin does not escape HTML content supplied in the message field of its post-build step. The affected component is the Jenkins Rich Text Publisher Plugin running on Jenkins instances that allow job configuration.

Attackers with permission to configure jobs can inject arbitrary script into the stored message, which executes in the browsers of other users who view the job status or build output. Successful exploitation allows the attacker to perform actions on behalf of the victim within the Jenkins context, such as reading sensitive data or modifying configuration, with a CVSS score of 5.4 reflecting the need for authenticated access and user interaction.

The Jenkins security advisory published on 2022-06-30 describes the issue under SECURITY-2332 and directs administrators to update the Rich Text Publisher Plugin to a version that properly escapes the message content.

EPSS for this CVE rose from lower values after disclosure to a peak of 0.1425 on 2025-12-11 before receding to the current score of 0.0910, indicating a period of increased exploitation interest that later subsided.