Skip to content
Sign in
Not rated

CVE-2022-29037 Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views…

Description

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product Affected versions Fixed in
Jenkins CVS Plugin 2.19 earliest → 2.19 No fix stated

Other CVEs of Jenkins CVS Plugin

The 3 CVEs of Jenkins CVS Plugin →
CVE-2020-2324 Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks Not rated CVE-2020-2184 A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and… Not rated
Track this CVE