cbcvebase.
CVE-2022-29036
published 2022-04-12

CVE-2022-29036: Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name…

PriorityP342medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
78.55%
99.5th percentile
Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
jenkinsbuild_step_plugin
jenkinscoordinator_plugin
jenkinscredentials< 2.6.1.12.6.1.1
jenkinscredentials>= 1055.v1346ba467ba1 < 1074.1076.v39c30cecb_0e21074.1076.v39c30cecb_0e2
jenkinscredentials>= 1105.vb_4e24a_c78b_81 < 1112.vc87b_7a_3597f61112.vc87b_7a_3597f6
jenkinscredentials_plugin
jenkinscvs_plugin
jenkinsdeprecated_groovy_libraries_plugin
jenkinsextended_choice_parameter_plugin
jenkinsgerrit_trigger_plugin
jenkinsgit_parameter_plugin
jenkinsgoogle_compute_engine_plugin
jenkinsinput_step_plugin
jenkinsjira_plugin
jenkinsjob_dsl_plugin
jenkinsjob_generator_plugin
jenkinsmask_passwords_plugin
jenkinsmaven_release_plugin
jenkinsnode_and_label_parameter_plugin
jenkinspromotion_names_in_promoted_builds_plugin
jenkinspublish_over_ftp_plugin
jenkinsrebuilder_plugin
jenkinsrelease_plugin
jenkinsshow_build_parameters_plugin
jenkinssubversion_plugin

Detection & IOCsextracted from sources · hover to see the quote

  • Look for unescaped name/description fields in Credentials parameters on Jenkins views — a stored XSS payload injected there by a user with Item/Configure permission indicates exploitation of this vulnerability.
  • ·Vulnerable versions are Jenkins Credentials Plugin 1111.v35a_307992395 and earlier; fixed versions are 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1 — ensure the installed plugin version is one of these patched releases.

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.