CVE-2022-34171

Cross-site Scripting vulnerability in Jenkins

5.4 MediumFix available

CVE-2022-34171 is a medium vulnerability (CVSS 5.4) in Jenkins, published June 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.58%, the 75th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.356.

What does this mean?

Severity: 5.4 MediumCVSS 3.1, NVD
Exploit chance: 1.58%EPSS, 75th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.356org.jenkins-ci.main:jenkins-core +14 more

Description

In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' (until Jenkins 2.334) and 'alt' attribute of 'l:icon' (since Jenkins 2.335) without further escaping, resulting in a cross-site scripting (XSS) vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.58%Up 0.7 points since Jun 23, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	2.350 up to 2.356	2.356
`org.jenkins-ci.main:jenkins-core` Maven	2.346 up to 2.346.1	2.346.1
`org.jenkins-ci.main:jenkins-core` Maven	before 2.332.4	2.332.4
`jenkins` Alpine:v3.16	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.17	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.18	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.19	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.20	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.21	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.22	2.321 up to 2.346.2-r0	2.346.2-r0

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`jenkins` Alpine:v3.23	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Alpine:v3.24	2.321 up to 2.346.2-r0	2.346.2-r0
`jenkins` Bitnami	2.321.0 up to 2.355.1	2.355.1
`org.jenkins-ci.main:jenkins-core` Maven	2.350 up to 2.356, plus listed versions 2.3542.355	2.356
`org.jenkins-ci.main:jenkins-core` Maven	before 2.332.4, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	2.332.4

What each source reports

NVD Score used5.4

Record: CVE-2022-34171
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2022-34171
Updated: 2026-11-02

EUVDEUVD-2022-5981No score

Record: EUVD-2022-5981
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7f84-p6r5-jr6q8.0

Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the title attribute of l:ionicon until Jenkins 2.334 and alt attribute of l:icon since Jenkins 2.335 without further escaping.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the title attribute of l:ionicon (Jenkins LTS 2.332.4) and alt attribute of l:icon (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.

Record: GHSA-7f84-p6r5-jr6q
CVSS 3.1: 8.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-22, CWE-79
Updated: 2026-11-02