Read the docs
TI-2022-15085 Aliases CVE-2022-34170GHSA-62wf-24c4-8r76

Cross-site scripting in Jenkins

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Why it matters now

EPSS 0.01564 75th percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.main:jenkins-core (Maven): 2.356, 2.332.4, 2.346.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins2.320 and later; up to 2.355; LTS 2.332.1 and later; up to LTS 2.332.3—No fix listedCNA
—org.jenkins-ci.main:jenkins-core (Maven)2.350 to before 2.3562.356Patch availableGHSA-62wf-24c4-8r76
—org.jenkins-ci.main:jenkins-core (Maven)2.320 to before 2.332.42.332.4Patch availableGHSA-62wf-24c4-8r76
—org.jenkins-ci.main:jenkins-core (Maven)2.346 to before 2.346.12.346.1Patch availableGHSA-62wf-24c4-8r76
  • Jenkins VendorJenkins Affected 2.320 and later; up to 2.355; LTS 2.332.1 and later; up to LTS 2.332.3 Fixed in — No fix listed CNA
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.350 to before 2.356 Fixed in 2.356 Patch available GHSA-62wf-24c4-8r76
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.320 to before 2.332.4 Fixed in 2.332.4 Patch available GHSA-62wf-24c4-8r76
  • org.jenkins-ci.main:jenkins-core (Maven) Vendor— Affected 2.346 to before 2.346.1 Fixed in 2.346.1 Patch available GHSA-62wf-24c4-8r76

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*2.320 – 2.355VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*2.332.1 – 2.332.3VulnerableJenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions 2.320 – 2.355 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions 2.332.1 – 2.332.3 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-62wf-24c4-8r76 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.356 Advisory →
  • Fix · GHSA-62wf-24c4-8r76 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.332.4 Advisory →
  • Fix · GHSA-62wf-24c4-8r76 org.jenkins-ci.main:jenkins-core (Maven) Fixed in 2.346.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Jenkins unspecified

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    Show all 5 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34170
  2. 2026-10-03 Alias added: GHSA-62wf-24c4-8r76

References

Advisory 2

Other 2

  • TI-2024-15885 Path traversal in Jenkins KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14573 Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
  • TI-2016-07596 The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers… CVSS 3.0CRITICAL 9.8
See all 293 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences