What’s Vulnerable › Vulnerabilities

CVE-2022-30956

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 73.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-17 · updated 2026-06-17
• Weakness: CWE-79

Description

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.

Affected products

• Jenkins project Jenkins Rundeck Plugin: through 3.6.10

References

• https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600
• https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2600

Get alerted when CVE-2022-30956 or the next vulnerability affects your stack