CVE-2022-46687

Deeper analysis

Jenkins Spring Config Plugin 2.0.0 and earlier contains a stored cross-site scripting vulnerability because the plugin fails to escape build display names rendered on the Spring Config view. The affected component is the Jenkins plugin responsible for displaying these names in its dedicated configuration interface, classified under CWE-79 with a CVSS 3.1 score of 5.4.

Attackers with permission to modify build display names can inject arbitrary script content that executes in the browsers of other users viewing the Spring Config page. Successful exploitation allows limited impacts on confidentiality and integrity within the Jenkins instance, requiring user interaction and operating across security contexts.

The Jenkins security advisory published on 2022-12-07 at the referenced URL details the issue under SECURITY-2814 and provides guidance for affected installations. The associated EPSS score remains low, with a modest peak of 0.1037 that has since declined to the current value of 0.0898.