CVE-2022-34173

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in…

published June 22, 2022

CVSS
—
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01473 · 73.6th percentile
Published
2022-06-22T14:40Z
EPSS history
Timeline
  • 22 JUN 14:40Z
    In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in…
    cvelistv5