CVE-2022-34178: 
Java vulnerability analysis and mitigation

Jenkins Embeddable Build Status Plugin version 2.0.3 contains a reflected cross-site scripting (XSS) vulnerability identified as CVE-2022-34178. The vulnerability was discovered and disclosed on June 22, 2022, affecting the plugin's link query parameter functionality for build status badges (Jenkins Advisory).

The vulnerability exists in the plugin's handling of the 'link' query parameter that build status badges will link to, where the plugin does not properly restrict or validate possible values. This implementation flaw allows for reflected cross-site scripting attacks. The vulnerability has been assigned a High severity rating (Jenkins Advisory).

The vulnerability enables reflected cross-site scripting (XSS) attacks, which could allow attackers to execute arbitrary web scripts or HTML in the context of the affected Jenkins instance. This could potentially lead to session hijacking, credential theft, or other malicious actions performed in the context of the user's browser (Jenkins Advisory).

The vulnerability has been fixed in Embeddable Build Status Plugin version 2.0.4. The fix implements two security measures: limiting URLs to http and https protocols, and correctly escaping the provided value. Users are advised to upgrade to version 2.0.4 or later to address this vulnerability (Jenkins Advisory).