CVE-2022-29037

published 2022-04-12

CVE-2022-29037: Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a…

Priority P4 23 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
jenkins	build_step_plugin	—	—
jenkins	coordinator_plugin	—	—
jenkins	credentials_plugin	—	—
jenkins	cvs	<= 2.19	—
jenkins	cvs_plugin	—	—
jenkins	deprecated_groovy_libraries_plugin	—	—
jenkins	extended_choice_parameter_plugin	—	—
jenkins	gerrit_trigger_plugin	—	—
jenkins	git_parameter_plugin	—	—
jenkins	google_compute_engine_plugin	—	—
jenkins	input_step_plugin	—	—
jenkins	jira_plugin	—	—
jenkins	job_dsl_plugin	—	—
jenkins	job_generator_plugin	—	—
jenkins	mask_passwords_plugin	—	—
jenkins	maven_release_plugin	—	—
jenkins	node_and_label_parameter_plugin	—	—
jenkins	promotion_names_in_promoted_builds_plugin	—	—
jenkins	publish_over_ftp_plugin	—	—
jenkins	rebuilder_plugin	—	—
jenkins	release_plugin	—	—
jenkins	show_build_parameters_plugin	—	—
jenkins	subversion_plugin	—	—
jenkins	unleash_maven_plugin	—	—
jenkins_project	jenkins_cvs_plugin	unspecified – 2.19	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79