CVE-2022-34783: Cross-site Scripting in Jenkins Plot Plugin
Summary
CVE-2022-34783: Cross-site Scripting in Jenkins Plot Plugin. Affects org.jenkins-ci.plugins:plot versions < 2.1.11. Fixed in 2.1.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Plot Plugin is a Maven package (org.jenkins-ci.plugins:plot) that provides functionality for creating and displaying plots in Jenkins. It allows users to generate various types of plots based on data collected during builds. The plugin is widely used in Jenkins instances for visualizing data and trends. However, versions 2.1.10 and earlier of the plugin are vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in Jenkins Plot Plugin arises from the lack of proper escaping of plot descriptions. Attackers with Item/Configure permission can exploit this vulnerability to inject malicious scripts into the plot descriptions. When other users view the affected plots, the injected scripts are executed in their browsers, leading to potential cross-site scripting attacks. This vulnerability has a CVSS score of 8.0, indicating a high severity level.
How To Fix
Latest published version: 698.v42408994b_b_b_a_ as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Plot Plugin or restrict access to it by revoking Item/Configure permission for untrusted users. However, this workaround may limit the functionality of the plugin and is not a permanent solution. It is strongly advised to apply the official fix by upgrading to the latest version of the plugin.
Conclusion
The Jenkins Plot Plugin versions 2.1.10 and earlier are vulnerable to a stored cross-site scripting (XSS) attack. Attackers with Item/Configure permission can inject malicious scripts into plot descriptions, leading to potential cross-site scripting attacks. To mitigate this vulnerability, users should upgrade to version 2.1.11 or later of the plugin. Applying the official fix will ensure proper escaping of plot descriptions and prevent the execution of injected scripts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:plot →
FAQ
The vulnerability allows attackers to execute arbitrary scripts in the context of other users' browsers, potentially leading to session hijacking, data theft, or other malicious activities.
Users of Jenkins instances with the Jenkins Plot Plugin versions 2.1.10 and earlier are affected by this vulnerability.
At the time of this advisory, there are no known public exploits targeting this vulnerability. However, it is advisable to apply the fix as soon as possible to mitigate the risk.
No, this vulnerability requires attackers to have Item/Configure permission in the Jenkins instance. Remote exploitation is not possible unless the attacker gains such permissions.
Yes, this vulnerability has a CVSS score of 8.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:plot.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
