CVE-2022-36922

Deeper analysis

The vulnerability is a reflected cross-site scripting flaw in the Jenkins Lucene-Search Plugin version 370.v62a5f618cd3a and earlier. The plugin fails to escape the search query parameter when rendering results on the search page, allowing attacker-controlled script content to be reflected back to users.

An unauthenticated attacker can exploit the issue by crafting a malicious link containing a script payload in the search parameter and tricking a Jenkins user into clicking it. Successful exploitation executes the script in the victim's browser session with the privileges of the Jenkins application, enabling theft of session tokens, redirection to attacker-controlled sites, or other actions within the changed security context.

The Jenkins security advisory published on 2022-07-27 addresses SECURITY-2812 and recommends that administrators update the Lucene-Search Plugin to a version that properly escapes the parameter. Corresponding notices were also distributed via the oss-security mailing list on the same date.

EPSS for the CVE rose from low values to a peak of 0.1625 on 2025-12-11 before receding to the current 0.0611, indicating a period of increased exploitation interest well after initial disclosure.