5.4

CVE-2022-34171: jenkins project jenkins Cross-site Scripting

Modified
AliasesGHSA-7f84-p6r5-jr6qBIT-jenkins-2022-34171
Published 22-06-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-34171 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in jenkins project jenkins. EPSS estimates a 1.56% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (NVD)
EPSS score
1.56%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 22-06-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

1.56%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

Increase +0.13 pp

From 1.43% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Jenkins1 product
  • jenkins≥ 2.321, ≤ 2.355 | ≥ 2.332.1, ≤ 2.332.3
Jenkins project1 product
  • jenkins≥ 2.321, < unspecified | ≥ unspecified, ≤ 2.355 | ≥ LTS 2.332.1, < unspecified | ≥ unspecified, ≤ LTS 2.332.3
Org.jenkins-ci.main1 product
  • jenkins-core≥ 2.350, < 2.356 | ≥ 2.346, < 2.346.1 | < 2.332.4

3 vendors · 3 products

References

3 links