{"id":"CVE-2022-34170","aliases":["ALPINE-CVE-2022-34170","BIT-jenkins-2022-34170","EUVD-2022-5949","GHSA-62wf-24c4-8r76"],"status":"published","title":"Cross-site Scripting vulnerability in Jenkins","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01589,"percentile":0.75958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-79"],"published":"2022-06-22T14:40:50Z","modified":"2026-11-03T07:30:20Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","fixed_in":["2.356","2.332.4","2.346.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"jenkins","fixed_in":["2.346.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jenkins","fixed_in":["2.355.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.350"},{"fixed":"2.356"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.332.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.346"},{"fixed":"2.346.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.346.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jenkins","ranges":[{"type":"SEMVER","events":[{"introduced":"2.320.0"},{"fixed":"2.355.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.350"},{"fixed":"2.356"}]}],"versions":["2.350","2.354","2.355"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.320"},{"fixed":"2.332.4"}]}],"versions":["2.320","2.321","2.322","2.323","2.324","2.325","2.326","2.327","2.328","2.329","2.330","2.331","2.332","2.332.1","2.332.2","2.332.3"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:jenkins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.346"},{"fixed":"2.346.1"}]}],"versions":["2.346"]}],"products":[{"vendor":"jenkins","product":"jenkins"},{"vendor":"jenkins project","product":"jenkins"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2781","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34170","tags":["web","advisory"]},{"url":"https://github.com/jenkinsci/jenkins/commit/f71495a63f8b861e8ca3a5fcf5cc931fce55bc57","tags":["web"]},{"url":"https://github.com/advisories/GHSA-62wf-24c4-8r76"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-34170","tags":["advisory"]},{"url":"https://github.com/jenkinsci/jenkins","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-34170","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2022-06-22T14:40:50Z","modified":"2024-08-03T08:16:17.207Z","updated_at":"2026-11-02T14:34:42.354707Z"}],"euvd":[{"id":"EUVD-2022-5949","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2022-06-22T14:40:50Z","modified":"2024-08-03T08:16:17Z","updated_at":"2026-11-03T03:25:29.025225Z"}],"ghsa":[{"id":"GHSA-62wf-24c4-8r76","title":"Cross-site Scripting vulnerability in Jenkins","description":"Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for [SECURITY-1955](https://www.jenkins.io/security/advisory/2020-08-12/#SECURITY-1955).\n\nThis vulnerability is known to be exploitable by attackers with Job/Configure permission.\n\nJenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.","status":"published","published":"2022-06-24T00:00:31Z","modified":"2024-03-13T18:04:02Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-79"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2022-34170","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2022-06-23T17:15:15.253Z","modified":"2026-06-17T04:49:50.41Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"ALPINE-CVE-2022-34170","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2022-06-23T17:15:15.253Z","modified":"2026-11-03T07:30:20.870788759Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-34170","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2022-06-23T17:15:15.253Z","modified":"2026-10-24T10:30:45.128407504Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"GHSA-62wf-24c4-8r76","title":"Cross-site Scripting vulnerability in Jenkins","description":"Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for [SECURITY-1955](https://www.jenkins.io/security/advisory/2020-08-12/#SECURITY-1955).\n\nThis vulnerability is known to be exploitable by attackers with Job/Configure permission.\n\nJenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.","status":"published","published":"2022-06-24T00:00:31Z","modified":"2024-03-13T18:18:09.602104Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-79"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"BIT-jenkins-2022-34170","description":"In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","status":"published","published":"2024-03-06T10:58:03.47Z","modified":"2026-09-08T08:47:57.751985427Z","updated_at":"2026-11-02T15:28:31.42203Z"}]}}