{"id":"CVE-2022-34173","details":"In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.","aliases":["BIT-jenkins-2022-34173","GHSA-6g4r-q7qg-6qx6"],"modified":"2026-07-09T06:35:30.872743Z","published":"2022-06-23T17:15:15.447Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2781"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/jenkins","events":[{"introduced":"39890e8c55879fc7c0e9b6cc2ba9920f37cd51f9"},{"last_affected":"d43d0b51dd18bca980f7d384ec4a353a2a66b818"}],"database_specific":{"cpe":"cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.340"},{"last_affected":"2.355"}],"source":"CPE_RANGE"}}],"versions":["jenkins-2.355","jenkins-2.354","jenkins-2.353","jenkins-2.352","jenkins-2.351","jenkins-2.350","jenkins-2.349","jenkins-2.348","jenkins-2.347","jenkins-2.346","jenkins-2.345","jenkins-2.344","jenkins-2.343","jenkins-2.342","jenkins-2.341","jenkins-2.340"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-34173.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}