CVE-2022-30966: 
Java vulnerability analysis and mitigation

CVE-2022-30966 is a stored cross-site scripting (XSS) vulnerability discovered in Jenkins Random String Parameter Plugin version 1.0 and earlier. The vulnerability was disclosed on May 17, 2022, as part of a larger Jenkins security advisory. The vulnerability affects the plugin's handling of parameter names and descriptions on views displaying parameters (Jenkins Advisory).

The vulnerability stems from the plugin's failure to properly escape the name and description of Random String parameters on views displaying parameters. This creates a stored cross-site scripting vulnerability that can be exploited by attackers who have Item/Configure permission. The vulnerability is tracked as SECURITY-2722 and has been assessed as High severity (Jenkins Advisory).

The vulnerability allows attackers with Item/Configure permission to execute stored cross-site scripting attacks through parameter names and descriptions. Exploitation requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' pages, and that those pages are not hardened against such attacks (Jenkins Advisory).

As of the advisory's publication on May 17, 2022, no fix was available for the Random String Parameter Plugin. The vulnerability remains present in version 1.0 and earlier versions of the plugin (Jenkins Advisory).