CVE-2022-34787

Deeper analysis

The vulnerability is a stored cross-site scripting flaw (CWE-79) in the Jenkins Project Inheritance Plugin 21.04.03 and earlier. The plugin fails to escape the reason a build is blocked when rendering that text inside tooltips, allowing attacker-controlled content to be interpreted as HTML or JavaScript by the browser.

Attackers who can influence the blocking reason for a queue item—typically users with permission to configure jobs or related objects—can supply a malicious payload. When another user views the affected queue or build page, the script executes in that user’s session, enabling actions such as stealing credentials or performing actions on the victim’s behalf within the Jenkins instance. The issue carries a CVSS 3.1 score of 5.4, reflecting network attack vector, low complexity, and the requirement for some user interaction.

The official Jenkins security advisory published on 2022-06-30 at https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-1919 addresses SECURITY-1919 and directs administrators to update the Project Inheritance Plugin to a version that properly escapes the tooltip content.

The EPSS probability rose from lower values after disclosure to a peak of 0.1425 on 2025-12-11 before receding to the current score of 0.0910, indicating measurable post-publication exploitation interest.