CVE-2022-34187

🗓️ 22 Jun 2022 14:41:17Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 115 Views🌐 WEB

Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier XSS vulnerabilit

Reporter	Title	Published	Views	Family All 19
attackerkb	CVE-2022-34187	23 Jun 202217:15	–	attackerkb
Circl	CVE-2022-34187	23 Jun 202220:42	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.14 / 2.332.4.1 / 2.346.1.4 Multiple Vulnerabilities (CloudBees Security Advisory 2022-06-22)	5 Jul 202200:00	–	nessus
Tenable Nessus	Jenkins LTS < 2.332.4 / Jenkins weekly < 2.356 Multiple Vulnerabilities	15 Jul 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-06-22)	15 Jul 202200:00	–	nessus
CNNVD	Jenkins Plugin Filesystem List Parameter Cross-Site Scripting Vulnerability	22 Jun 202200:00	–	cnnvd
CNVD	Jenkins Filesystem List Parameter Plugin Cross-Site Scripting Vulnerability	24 Jun 202200:00	–	cnvd
Cvelist	CVE-2022-34187	22 Jun 202214:41	–	cvelist
Github Security Blog	Cross-site Scripting in Jenkins Filesystem List Parameter Plugin	24 Jun 202200:00	–	github
GitLab Advisory Database	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	24 Jun 202200:00	–	gitlab

NVD

Vulners

Node

jenkins filesystem_list_parameterRange≤0.0.7jenkins

[
  {
    "product": "Jenkins Filesystem List Parameter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "0.0.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unknown",
        "version": "next of 0.0.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
jenkins	www.jenkins.io/security/advisory/2022-06-22/

Parameter	Position	Path	Description	CWE
name	path	/job/*	Stored XSS in Jenkins Filesystem List Parameter Plugin where the 'name' and 'description' of File system objects list parameters are not escaped when displayed on views.	CWE-79
description	path	/job/*	Stored XSS in Jenkins Filesystem List Parameter Plugin where the 'name' and 'description' of File system objects list parameters are not escaped when displayed on views.	CWE-79

17 Jun 2026 04:49Current

5.2Medium risk

Vulners AI Score5.2

CVSS 23.5

CVSS 3.15.4

EPSS0.00804

CWE-79