How severe is CVE-2022-30950?

CVE-2022-30950 has a CVSS score of 4.2/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by CVE-2022-30950?

CVE-2022-30950 affects the following packages: org.jenkins-ci.plugins:windows-slaves (Maven). Ecosystems affected: Maven.

How do I fix CVE-2022-30950?

Update org.jenkins-ci.plugins:windows-slaves to 1.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-30950 is resolved across your whole dependency graph.

How do I detect CVE-2022-30950 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.jenkins-ci.plugins:windows-slaves, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2022-30950 if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is CVE-2022-30950 actively exploited in the wild?

No public exploit code has been indexed for CVE-2022-30950 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2022-30950?

CVE-2022-30950 has an EPSS (Exploit Prediction Scoring System) score of 1.9%, placing it in the 80th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2022-30950?

CVE-2022-30950 is classified as CWE-120 (CWE-120). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2022-30950 published, and has it been updated?

CVE-2022-30950 was published on May 18, 2022 and was last updated on November 8, 2023. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

MEDIUM severity

CVE-2022-30950 — windows-slaves

MEDIUMFix: jenkinsci/windows-slaves-plugin@4638cf0

CVE-2022-30950 is a medium-severity (CVSS 4.2) CWE-120 vulnerability in org.jenkins-ci.plugins:windows-slaves. A fix is available for org.jenkins-ci.plugins:windows-slaves — see the affected versions and patch details below.

Buffer overflow in Jenkins WMI Windows Agents plugin

Published

May 18, 2022

Updated

Nov 8, 2023

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

1.9%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs80th percentile — riskier than 80% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

☕org.jenkins-ci.plugins:windows-slaves

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

This library has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.

Additionally, while the processes are started as the user who connects to the named pipe, no access control takes place, potentially allowing users to start processes even if they’re not allowed to log in.

WMI Windows Agents Plugin 1.8.1 no longer includes the Windows Remote Command library. A Java runtime is expected to be available on agent machines and WMI Windows Agents Plugin 1.8.1 does not install a JDK automatically otherwise.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`org.jenkins-ci.plugins:windows-slaves`	all versions	1.8.1`org.jenkins-ci.plugins:windows-slaves:1.8.1`

Affected Products

1 product · 1 configurations

Application

wmi windows agentsjenkins

< 1.8.1

range

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.jenkins-ci.plugins:windows-slaves, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.jenkins-ci.plugins:windows-slaves to 1.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-30950 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library. It provides a general-purpose remote command execution capability that Jenkins uses to check if Java is available, and if not, to install it. This library has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine. Additionally, while the processes are started as the user who connects to the named pipe, no access control takes place, potentially allowing users to start processes even if they’re not allowed to log in. WMI Window

O3 Security · Impact-Aware SCA

Is CVE-2022-30950 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

4.2/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Raw vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE Classification

CWE-120CWE-120

Weaponization

No Nuclei template, Metasploit module or public proof-of-concept found.

Timeline

Disclosed

May 18, 2022

Last updated

Nov 8, 2023

Identifiers

CVE-2022-30950

References

Advisorynvd.nist.gov · CVE 2022 30950 Webgithub.com · 4638cf0e56caf839eadfdf0fab545abd2a9ac65e Webjenkins.io · 2022 05 17 Webopenwall.com Packagegithub.com · windows slaves plugin

Related vulnerabilities

Also affects windows-slaves

This CVE is medium severity, in line with the other 1 CVE affecting windows-slaves.

CVE-2022-30951

Same weakness: CWE-120

This CVE is medium severity; 7 of 7 other CVEs with CWE-120 are rated as high or higher (top: critical).

CVE-2026-55209CVE-2022-41793CVE-2025-26240CVE-2026-54257GHSA-hc3c-63hc-2r9fCVE-2026-27820CVE-2025-64182Browse all CWE-120

Provenance

Sources

OSV.devNVDFIRST.org (EPSS)

Last verifiedNov 8, 2023