CVE-2022-30956: Jenkins Rundeck Plugin stored XSS via unrestricted webhook URL schemes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (5.4) with required privileges and user interaction, but the high EPSS percentile and stored nature warrant prompt patching.

What it is

The Jenkins Rundeck Plugin (3.6.10 and earlier) does not restrict URL schemes in Rundeck webhook submissions, allowing crafted webhook payloads to be stored and later rendered as script in a victim's browser. Because the payload persists in Jenkins, any user who views the affected content can trigger it, making it a stored cross-site scripting issue rather than a one-off reflected flaw.

Impact

An attacker who can submit webhook payloads can execute script in the context of a victim's Jenkins session, potentially stealing session data or performing actions as that user. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through Rundeck webhook submissions to the Jenkins Rundeck Plugin; the vector requires low privileges (PR:L) and user interaction (UI:R) from a victim who views the stored content. No authentication bypass is described, so the attacker needs a position allowing webhook submission.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged beyond the vendor advisory, but EPSS is high at 0.73254 (99.4th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade the Jenkins Rundeck Plugin past 3.6.10 to the fixed version listed in the Jenkins security advisory SECURITY-2600.
• If immediate upgrade is not possible, restrict who can submit Rundeck webhook payloads to Jenkins.
• Apply a Content Security Policy to Jenkins that blocks inline and untrusted script execution.
• Review and sanitize stored webhook content and clear any suspicious stored payloads.
• Monitor the Jenkins advisory page for updated fixed versions.

Detection

• Search Jenkins logs and stored webhook data for payloads containing script tags or non-HTTP URL schemes.
• Alert on Rundeck webhook submissions from unexpected source accounts or IPs.
• Monitor for anomalous browser-side activity or session use by Jenkins users who viewed webhook content.
• Audit Jenkins plugin inventory for Rundeck Plugin versions at or below 3.6.10.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.