CVE-2022-20615

CWE-79 — Cross-site Scripting (XSS)7 documents7 sources
Severity
5.4MEDIUM
EPSS
2.9%
top 13.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Jenkins Project Jenkins Matrix Project PluginJenkins Matrix ProjectOracle Communications Cloud Native Core Automated Test Suite
Timeline
PublishedJan 12
Latest updateApr 15

Description

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5jenkins_project/jenkins_matrix_project_pluginunspecified — 1.19

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
OSV
Stored XSS vulnerability in Matrix Project Plugin↗2022-01-13
▶
GHSA
Stored XSS vulnerability in Matrix Project Plugin↗2022-01-13
▶
CVEList
CVE-2022-20615: Jenkins Matrix Project Plugin 1↗2022-01-12
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Communications Risk Matrix: Automated Test Suite Framework (Jenkins Matrix Project) — CVE-2022-20615↗2022-04-15
▶
Jenkins
Jenkins Security Advisory 2022-01-12↗2022-01-12
▶
Red Hat
jenkins-2-plugins/matrix-project: does not escape HTML metacharacters which could result in XSS↗2022-01-12
▶