CVE-2022-27202

Name of the Vulnerable Software and Affected Versions Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not escape the value and description of extended choice parameters of radio buttons or check boxes type. Attackers with Item/Configure permission can exploit this vulnerability.

Recommendations For Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier, consider updating to a version that fixes the stored cross-site scripting (XSS) vulnerability. As a temporary workaround, restrict access to the extended choice parameters of radio buttons or check boxes type to minimize the risk of exploitation.