CVE-2022-29046
published 2022-04-12CVE-2022-29046: Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
2.44%
82.4th percentile
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | >= 12.0 < 12.5 | 12.5 |
| apple | macos_monterey | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | coordinator_plugin | — | — |
| jenkins | credentials_plugin | — | — |
| jenkins | cvs_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | extended_choice_parameter_plugin | — | — |
| jenkins | gerrit_trigger_plugin | — | — |
| jenkins | git_parameter_plugin | — | — |
| jenkins | google_compute_engine_plugin | — | — |
| jenkins | input_step_plugin | — | — |
| jenkins | jira_plugin | — | — |
| jenkins | job_dsl_plugin | — | — |
| jenkins | job_generator_plugin | — | — |
| jenkins | mask_passwords_plugin | — | — |
| jenkins | maven_release_plugin | — | — |
| jenkins | node_and_label_parameter_plugin | — | — |
| jenkins | promotion_names_in_promoted_builds_plugin | — | — |
| jenkins | publish_over_ftp_plugin | — | — |
| jenkins | rebuilder_plugin | — | — |
| jenkins | release_plugin | — | — |
| jenkins | show_build_parameters_plugin | — | — |
| jenkins | subversion | <= 2.15.3 | — |
| jenkins | subversion_plugin | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
ghsa5.4MEDIUM
osv5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Subversion Plugin up to 2.15.3 on Jenkins cross site scripting (Nessus ID 312087)
vuldb·2026-05-05·CVSS 5.4
CVE-2022-29046 [MEDIUM] Subversion Plugin up to 2.15.3 on Jenkins cross site scripting (Nessus ID 312087)
A vulnerability identified as problematic has been detected in Subversion Plugin up to 2.15.3 on Jenkins. This vulnerability affects unknown code. The manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2022-29046. Remote exploitation of the attack is possible. No exploit is available.
VulDB
Apple macOS subversion cross site scripting (HT213345 / Nessus ID 312087)
vuldb·2026-05-05·CVSS 5.4
CVE-2022-29046 [MEDIUM] Apple macOS subversion cross site scripting (HT213345 / Nessus ID 312087)
A vulnerability classified as problematic was found in Apple macOS. The impacted element is an unknown function of the component subversion. Executing a manipulation can lead to cross site scripting.
The identification of this vulnerability is CVE-2022-29046. The attack needs to be done within the local network. There is no exploit available.
Upgrading the affected component is advised.
OSV
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
osv·2022-04-13·CVSS 5.4
CVE-2022-29046 [MEDIUM] Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](
GHSA
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
ghsa·2022-04-13·CVSS 5.4
CVE-2022-29046 [MEDIUM] CWE-79 Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](
Apple
CVE-2022-29046: macOS Monterey 12.5
vendor_apple·2022-07-20·CVSS 5.4
CVE-2022-29046 [MEDIUM] CVE-2022-29046: macOS Monterey 12.5
Apple Security Update: About the security content of macOS Monterey 12.5
Product: macOS Monterey
Version: 12.5
CVE: CVE-2022-29046
Component: Spotlight
Impact: An app may be able to gain root privileges
Description: This issue was addressed with improved checks.
Jenkins
Jenkins Security Advisory 2022-04-12
vendor_jenkins·2022-04-12·CVSS 5.4
CVE-2017-2601 [MEDIUM] Jenkins Security Advisory 2022-04-12
Title: Jenkins Security Advisory 2022-04-12
Jenkins Security Advisory 2022-04-12
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Credentials
Plugin
CVS
Plugin
Extended Choice Parameter
Plugin
Gerrit Trigger
Plugin
Git Parameter
Plugin
Google Compute Engine
Plugin
Jira
Plugin
Job Generator
Red Hat
subversion: Stored XSS vulnerabilities in Jenkins subversion plugin
vendor_redhat·2022-04-12·CVSS 5.4
CVE-2022-29046 [MEDIUM] CWE-79 subversion: Stored XSS vulnerabilities in Jenkins subversion plugin
subversion: Stored XSS vulnerabilities in Jenkins subversion plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
A flaw was found in the Jenkins Subversion plugin. The Jenkins subversion plugin does not escape the name and description of List Subversion tags and parameters on views displaying the parameters. This issue results in a stored Cross-site scripting (XSS) vulnerability, exploitable by attackers with Item/Configure permission.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-04-12
Published