CVE-2022-34182: Reflected Cross-site Scripting in Jenkins Nested View Plugin
Summary
CVE-2022-34182: Reflected Cross-site Scripting in Jenkins Nested View Plugin. Affects org.jenkins-ci.plugins:nested-view versions >= 1.20, < 1.26. Fixed in 1.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Nested View Plugin is a Maven package (org.jenkins-ci.plugins:nested-view) that provides functionality for creating nested views in the Jenkins continuous integration and delivery platform. It allows users to organize and manage their Jenkins views in a hierarchical structure. This plugin is widely used by Jenkins users to improve the organization and navigation of their projects.
Vulnerability Detail
The Jenkins Nested View Plugin versions 1.20 through 1.25 (inclusive) are vulnerable to a reflected cross-site scripting (XSS) attack. This vulnerability occurs due to the plugin's failure to properly escape search parameters. An attacker can exploit this vulnerability by injecting malicious code into search parameters, which will be executed in the context of the victim's browser. This can lead to various security risks, including unauthorized access, data theft, and further exploitation of the affected system. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2022-34182. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 241.v178f0b_a_cd76a_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The Jenkins Nested View Plugin versions 1.20 through 1.25 are vulnerable to a reflected cross-site scripting (XSS) attack. This can lead to unauthorized access, data theft, and further exploitation of the affected system. It is crucial to update the plugin to version 1.26 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:nested-view →
FAQ
This vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to unauthorized access, data theft, and further exploitation of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to update the plugin to the fixed version to prevent potential exploitation.
No, updating the plugin to the fixed version is the recommended and most effective way to mitigate the risk of exploitation. There are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-h642-5h74-3x9c/GHSA-h642-5h74-3x9c.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:nested-view.
