CVE-2022-29043

2022-04-1220:15:09

Google

osv.dev

0.001 Low

EPSS

Percentile

22.3%

JSON

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
mask-passwords-plugineqmask-passwords-2.12.0
mask-passwords-plugineqmask-passwords-2.9
mask-passwords-plugineqmask-passwords-3.0
mask-passwords-plugineqmask-passwords-2.10
mask-passwords-plugineqmask-passwords-2.8
mask-passwords-plugineqmask-passwords-2.13
mask-passwords-plugineqmask-passwords-2.10.1
mask-passwords-plugineqmask-passwords-2.7.4
mask-passwords-plugineqmask-passwords-2.11.0
mask-passwords-plugineqmask-passwords-2.7.3

Name	Operator	Version
mask-passwords-plugin	eq	mask-passwords-2.12.0
mask-passwords-plugin	eq	mask-passwords-2.9
mask-passwords-plugin	eq	mask-passwords-3.0
mask-passwords-plugin	eq	mask-passwords-2.10
mask-passwords-plugin	eq	mask-passwords-2.8
mask-passwords-plugin	eq	mask-passwords-2.13
mask-passwords-plugin	eq	mask-passwords-2.10.1
mask-passwords-plugin	eq	mask-passwords-2.7.4
mask-passwords-plugin	eq	mask-passwords-2.11.0
mask-passwords-plugin	eq	mask-passwords-2.7.3

References

www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617

0.001 Low

EPSS

Percentile

22.3%

JSON

Related for OSV:CVE-2022-29043