cbcvebase.
CVE-2022-20615
published 2022-01-12

CVE-2022-20615: Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored…

PriorityP342medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
81.84%
99.6th percentile
Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
jenkinsactive_directory_plugin
jenkinsbadge_plugin
jenkinsbitbucket_branch_source_plugin
jenkinsconfiguration_as_code_plugin
jenkinsconjur_secrets_plugin
jenkinscredentials_binding_plugin
jenkinscredentials_plugin
jenkinsdebian_package_builder_plugin
jenkinsdocker_commons_plugin
jenkinsgroovy_plugin
jenkinshashicorp_vault_plugin
jenkinsids_in_bitbucket_branch_source_plugin
jenkinsimproper_credentials_masking_in_hashicorp_vault_plugin
jenkinsjenkins_core
jenkinsjenkins_lts
jenkinsjenkins_ui_requesting_they_update_the_plugin
jenkinsjenkins_weekly
jenkinsmailer_plugin
jenkinsmatrix_project<= 1.19
jenkinsmatrix_project_plugin
jenkinsmetrics_plugin
jenkinspublish_over_ssh_plugin
jenkinsssh_agent_plugin
jenkinswarnings_plugin
jenkins_projectjenkins_matrix_project_pluginunspecified – 1.19

Detection & IOCsextracted from sources · hover to see the quote

  • Stored XSS is injected via node names, label names, or label descriptions in Jenkins Matrix Project Plugin — monitor for unescaped HTML metacharacters (e.g., <, >, ", ') in these fields
  • Exploitation requires Agent/Configure permission — alert on privilege assignments to this role in Jenkins, especially for untrusted users
  • Audit Jenkins Matrix Project Plugin version; versions 1.19 and earlier are vulnerable — flag installations of jenkins-2-plugins on OpenShift Container Platform 3.11 and 4
  • ·Exploitation is only possible for authenticated users holding Agent/Configure permission; attack surface is limited to privileged internal users, not anonymous/remote attackers
  • ·Red Hat has marked jenkins-2-plugins on OpenShift Container Platform 3.11 as 'Will not fix', meaning patching may not be available for that platform version
  • ·Oracle classifies this as non-remotely exploitable despite being an HTTP-protocol vulnerability, consistent with the requirement for an authenticated session with specific permissions

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_oracle5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.