CVE-2022-29038 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a_86c and earlier, stemming from improper escaping of parameter names and descriptions on views. Rated Medium with a CVSS score of 5.4, exploitation requires low privileges (Item/Configure permission) and user interaction, potentially leading to limited confidentiality and integrity impact. There is no evidence of active exploitation or public exploit code in common repositories like Metasploit or ExploitDB, though it has generated significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 346.vd87693c5a_86cCPE matchmatch criteria | cpe:2.3:a:jenkins:extended_choice_parameter:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.