CVE-2022-29038

MEDIUM

Jenkins Extended Choice Parameter Plugin <346.vd87693c5a_86c - XSS

Title source: llm

Description

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

References (1)

[Vendor Advisory] https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617

Scores

CVSS v3 5.4

EPSS 0.1755

EPSS Percentile 95.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-79

Status published

Affected Products (2)

jenkins/extended_choice_parameter < 346.vd87693c5a_86c

org.jenkins-ci.plugins/extended-choice-parameter Maven

Timeline

Published Apr 12, 2022

Tracked Since Feb 18, 2026