CVE-2022-38664
Cross-site Scripting in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
- Record
CVE-2022-38664- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
- Record
CVE-2022-38664- Updated
- 2026-11-02
EUVDEUVD-2022-6457 No score
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
- Record
EUVD-2022-6457- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-28w4-h56g-grg7
Cross-site Scripting in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
- Record
GHSA-28w4-h56g-grg7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-28w4-h56g-grg7
Cross-site Scripting in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
- Record
GHSA-28w4-h56g-grg7- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven |
through 1165.v8cc9fd1f4597 | 1166.vc9f255f45b |
org.jenkins-ci.plugins:jobConfigHistoryMaven |
before 1166.vc9f255f45b, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_51156.v536a_97b_8d6491163.ve82c7c6e60a_31165.v8cc9fd1f45972.02.12.1.12.102.112.122.132.142.152.162.172.182.18.12.18.22.18.32.192.22.202.212.222.232.23.12.242.252.262.272.282.28.12.292.29-rc1073.41ef89cf4e152.32.302.31-rc1092.de9e11acbcf32.31-rc1098.b666422863b22.31-rc1107.2354f08725a_82.31-rc1118.fdcd7d8898ff2.4 |
1166.vc9f255f45b |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-38664 is a medium vulnerability (CVSS 5.4) in Jenkins Job Configuration History, published August 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1166.vc9f255f45b.
References
jenkins.io/security/advisory/2022-08-23
openwall.com/lists/oss-security/2022/08/23/2
nvd.nist.gov/vuln/detail/CVE-2022-38664
github.com/jenkinsci/job-config-history-plugin/commit/c9f255f45b8a6ed008d66be094526adfd80ca035
Left out here: 4 versions. The JSON record has them.