CVE-2022-34185
Description
Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
me.leejay.jenkins:date-parameterMaven | <= 0.0.4 | — |
Affected products
2- Range: unspecified
Patches
Vulnerability mechanics
Root cause
"Missing HTML escaping of the name and description fields in the Date parameter's Jelly view allows stored cross-site scripting."
Attack vector
An attacker with Item/Configure permission can set a malicious name or description on a Date parameter. When a user views a page that displays that parameter, the unescaped value is rendered in the browser, allowing arbitrary JavaScript execution. This is a stored cross-site scripting (XSS) attack [CWE-79] that triggers whenever any user navigates to the affected view.
What the fix does
Both patches modify `index.jelly` to wrap `it.name` with `h.escape()` and use `it.formattedDescription` instead of raw `it.description`. The `h.escape()` function HTML-encodes the parameter name, and `formattedDescription` applies the same escaping to the description. This prevents attacker-controlled strings from being interpreted as HTML or JavaScript. The patches also bump the parent plugin version and Jenkins baseline to ensure the escaping helpers are available.
Preconditions
- authAttacker must have Item/Configure permission on a Jenkins job
- inputThe job must use a Date parameter with a crafted name or description
- networkA victim must view a page that renders the parameter (e.g., the job configuration or build page)
Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3- github.com/advisories/GHSA-5hh2-f4h9-446gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-34185ghsaADVISORY
- www.jenkins.io/security/advisory/2022-06-22/ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.