CVE-2022-43425

Deeper analysis

Jenkins Custom Checkbox Parameter Plugin 1.4 and earlier contains a stored cross-site scripting vulnerability because it fails to escape the name and description fields of Custom Checkbox Parameter definitions when those parameters are rendered on views. The affected component is the Jenkins plugin that provides this parameter type for job configuration.

Attackers who possess Item/Configure permission can supply malicious payloads in the parameter name or description; these payloads are stored and later executed in the browsers of other users who view the parameter settings, enabling theft of credentials or other actions within the Jenkins instance under the victim's permissions.

The Jenkins security advisory published on 2022-10-19 and the corresponding oss-security mailing list posting describe the issue as SECURITY-2797 and direct administrators to update the plugin to a version that performs proper escaping of the affected fields.

The EPSS score rose from a low baseline to a peak of 0.0848 before receding to its current value of 0.0379, indicating that exploitation interest increased after disclosure.