credentials: Stored XSS vulnerabilities in jenkins plugin

🗓️ 22 Mar 2022 17:31:21Reported by RedHatType

Stored cross site scripting in the Jenkins credentials plugin occurs when parameter names and descriptions are not escaped in views.

Reporter	Title	Published	Views	Family All 46
ATTACKERKB	CVE-2022-29036	12 Apr 202220:15	–	attackerkb
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)	16 May 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-04-12)	23 May 202200:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.8.35 (RHSA-2022:0871)	23 Mar 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.10.12 (RHSA-2022:1600)	2 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	19 May 202200:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.705 (RHSA-2022:2280)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.6.59 (RHSA-2022:4947)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.8.35 (RHSA-2022:0871)	6 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins-2-plugins	4.8.1646993358-1.el8	jenkins-2-plugins-4.8.1646993358-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-29036
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29036
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2022-04-12/

21 Mar 2026 04:24Current

5.7Medium risk

Vulners AI Score5.7

CVSS 23.5

CVSS 3.15.4

EPSS0.7855