CVE-2022-30967: 
Java vulnerability analysis and mitigation

CVE-2022-30967 is a stored cross-site scripting (XSS) vulnerability affecting the Selection tasks Plugin version 1.0 and earlier in Jenkins. The vulnerability was disclosed on May 17, 2022, as part of a larger Jenkins security advisory. The issue specifically affects the parameter types provided by the plugin (Jenkins Advisory).

The vulnerability exists because the Selection tasks Plugin does not properly escape the name and description of the parameter types it provides. This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers who have Item/Configure permission. The vulnerability is tracked as SECURITY-2728 and has been assigned a High severity CVSS rating (Jenkins Advisory).

The vulnerability allows attackers with Item/Configure permission to execute stored cross-site scripting (XSS) attacks. Exploitation requires that parameters are listed on pages like 'Build With Parameters' and 'Parameters' pages provided by Jenkins core, and that those pages are not hardened to prevent exploitation (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Item/Configure permission in Jenkins. However, Jenkins core has implemented protections against exploitation of this type of vulnerability on the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix (Jenkins Advisory).

As of the advisory publication on May 17, 2022, there was no fix available for the Selection tasks Plugin 1.0 and earlier. Users are advised to monitor for updates and implement general Jenkins security best practices until a patch becomes available (Jenkins Advisory).