CVE-2022-29045: 
Java vulnerability analysis and mitigation

CVE-2022-29045 is a security vulnerability affecting the Jenkins promoted builds Plugin versions 873.v6149db_d64130 and earlier, except version 3.10.1. The vulnerability was disclosed on April 12, 2022, as part of a broader Jenkins security advisory (Jenkins Advisory).

The vulnerability is a stored cross-site scripting (XSS) issue that occurs because the plugin does not properly escape the name and description of Promoted Build parameters on views displaying parameters. The vulnerability has been assigned a High severity CVSS rating (NVD).

This vulnerability allows attackers with Item/Configure permission to execute stored cross-site scripting (XSS) attacks through the manipulation of parameter names and descriptions. The exploitation requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' pages, and that those pages are not hardened to prevent exploitation (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Item/Configure permission in the Jenkins environment. The exploitation specifically requires access to parameter configuration and depends on how parameters are displayed on various Jenkins pages (Jenkins Advisory).

The vulnerability has been fixed in promoted builds Plugin versions 876.v99d29788b_36b_ and 3.10.1. Users are strongly advised to upgrade to these versions to mitigate the security risk. The fix includes proper escaping of parameter names and descriptions (Jenkins Advisory).