CVE-2022-29036: XSS
A flaw was found in the Jenkins credentials plugin. The Jenkins credentials plugin does not escape the name and description of Credentials parameters on views displaying parameters. This issue results in a stored Cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Other sources
Jenkins Credentials Plugin 1111.v35a307992395 and earlier, except 1087.1089.v2f1b9ab040e4, 1074.1076.v39c30cecb0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-29036?
CVE-2022-29036 is classified as a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2022-29036?
To fix CVE-2022-29036, update the Jenkins Credentials Plugin to version 2.6.1.1 or later.
Which versions of Jenkins are affected by CVE-2022-29036?
CVE-2022-29036 affects Jenkins Credentials Plugin version 1111.v35a_307992395 and earlier, but not versions 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1.
What type of vulnerability is CVE-2022-29036?
CVE-2022-29036 is a stored cross-site scripting (XSS) vulnerability that occurs due to insufficient escaping of parameters in views.
Is there any workaround for CVE-2022-29036?
There are no known workarounds for CVE-2022-29036; the recommended action is to update to a patched version of the plugin.