CVE-2022-36922: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displ...

Security readout for executives and security teams

Jenkins Lucene-Search Plugin versions 370.v62a5f618cd3a and earlier can reflect unescaped search input on a search results page. In business terms, a malicious link could cause script execution in a user's browser if the vulnerable page is reached. The sources do not provide CVSS, a fixed version, or active exploitation evidence. Exposure is limited to Jenkins environments with the Lucene-Search Plugin installed at 370.v62a5f618cd3a or earlier. Internet-facing or broadly accessible Jenkins interfaces increase concern, but the provided sources do not confirm reachability requirements. Prioritize review if Jenkins is externally reachable or used by administrators with broad privileges. The issue is not evidenced as actively exploited, but reflected XSS in CI/CD infrastructure can create meaningful operational risk. Mitigation focus: Inventory Jenkins instances for Lucene-Search Plugin and installed version.; Check Jenkins advisory and plugin guidance for fixed release or removal advice.; Restrict Jenkins access to trusted users while remediation is assessed..

Prepared

Jun 2, 2026, 02:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.