CVE-2022-29040

2022-04-1220:15:09

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
git-parameter-plugineqgit-parameter-0.3.2
git-parameter-plugineqgit-parameter-0.5.1
git-parameter-plugineqgit-parameter-0.9.12
git-parameter-plugineqgit-parameter-0.9.13
git-parameter-plugineqgit-parameter-0.6.0
git-parameter-plugineqgit-parameter-0.8.0
git-parameter-plugineqgit-parameter-0.7.2
git-parameter-plugineqgit-parameter-0.3.1
git-parameter-plugineqgit-parameter-0.9.8
git-parameter-plugineqgit-parameter-0.9.11

Name	Operator	Version
git-parameter-plugin	eq	git-parameter-0.3.2
git-parameter-plugin	eq	git-parameter-0.5.1
git-parameter-plugin	eq	git-parameter-0.9.12
git-parameter-plugin	eq	git-parameter-0.9.13
git-parameter-plugin	eq	git-parameter-0.6.0
git-parameter-plugin	eq	git-parameter-0.8.0
git-parameter-plugin	eq	git-parameter-0.7.2
git-parameter-plugin	eq	git-parameter-0.3.1
git-parameter-plugin	eq	git-parameter-0.9.8
git-parameter-plugin	eq	git-parameter-0.9.11