Read the docs
TI-2022-18197 Aliases CVE-2022-38664GHSA-28w4-h56g-grg7

Cross-site scripting in Jenkins Job Configuration History Plugin

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.

Why it matters now

EPSS 0.00709 53rd percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:jobConfigHistory (Maven): 1166.vc9f255f45b

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Job Configuration History Pluginup to 1165.v8cc9fd1f4597—No fix listedCNA
—org.jenkins-ci.plugins:jobConfigHistory (Maven)before 1166.vc9f255f45b1166.vc9f255f45bPatch availableGHSA-28w4-h56g-grg7
  • Jenkins Job Configuration History Plugin VendorJenkins Affected up to 1165.v8cc9fd1f4597 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:jobConfigHistory (Maven) Vendor— Affected before 1166.vc9f255f45b Fixed in 1166.vc9f255f45b Patch available GHSA-28w4-h56g-grg7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:job_configuration_history:*:*:*:*:*:jenkins:*:*up to 1165.v8cc9fd1f4597VulnerableJenkins
  • cpe:2.3:a:jenkins:job_configuration_history:*:*:*:*:*:jenkins:*:* Versions up to 1165.v8cc9fd1f4597 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-28w4-h56g-grg7 org.jenkins-ci.plugins:jobConfigHistory (Maven) Fixed in 1166.vc9f255f45b Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38664
  2. 2026-10-03 Alias added: GHSA-28w4-h56g-grg7

References

Advisory 3

Other 2

  • TI-2023-22318 XML external entity injection in Jenkins Job Configuration History Plugin CVSS 3.1HIGH 8.8
  • TI-2023-22317 XML external entity injection in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 6.5
  • TI-2023-22316 Cross-site scripting in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 5.4
  • TI-2023-22315 Path traversal in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 4.3
  • TI-2022-17102 Cross-site request forgery in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 4.3
  • TI-2026-41224 Cleartext storage of sensitive information in Jenkins Job Configuration History Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences