{"id":"CVE-2022-20615","published":"2022-01-12T19:05:49Z","modified":"2024-08-03T02:17:52Z","title":"Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label…","vendor":"Jenkins project","product":"Jenkins Matrix Project Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Matrix Project Plugin","versions":[">= unspecified, <= 1.19"]}],"description":{"text":"Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins Matrix Project Plugin, versions 1.19 and earlier, fails to escape HTML metacharacters in node and label names and in label descriptions, creating a stored cross-site scripting flaw. An attacker holding Agent/Configure permission can plant script payloads in those fields, which then execute in the browsers of other users who view them.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:50Z"},"cvss":null,"epss":{"score":0.81842,"percentile":0.99647,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":2,"pulses":[{"name":"Oracle Critical Patch Update Advisory - April 2022","url":"https://otx.alienvault.com/pulse/626040216e00cd388b1b9180","created":"2022-04-20"},{"name":"Jenkins Multiple Vulnerabilities","url":"https://otx.alienvault.com/pulse/61e4ff746b6fdfb8668d9125","created":"2022-01-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2017","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/12/6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":[">=1.19, <1.20","<1.18.1"],"patched":["1.20","1.18.1"],"from":["GHSA-vqwg-4v6f-h6x5"],"provenance":"source"}],"advisories":[{"id":"GHSA-vqwg-4v6f-h6x5","url":"https://github.com/advisories/GHSA-vqwg-4v6f-h6x5","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":[">=1.19, <1.20"],"patched":["1.20"],"provenance":"source","from":"GHSA"},{"id":"GHSA-vqwg-4v6f-h6x5","url":"https://github.com/advisories/GHSA-vqwg-4v6f-h6x5","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:matrix-project","vulnerableRanges":["<1.18.1"],"patched":["1.18.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0707","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0707","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-01-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-20615","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":21.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9965"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2019-1003031","published":"2019-03-08","fixed":"1.14","kev":false},{"cve":"CVE-2020-2224","published":"2020-07-15","fixed":"1.17","kev":false},{"cve":"CVE-2020-2225","published":"2020-07-15","fixed":"1.17","kev":false,"link":{"from":"CVE-2020-2225","to":"CVE-2022-20615","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:matrix-project","fromFixed":"1.17","toFixed":"1.18.1","daysApart":546}]}},{"cve":"CVE-2022-20615","published":"2022-01-12","fixed":"1.20","kev":false},{"cve":"CVE-2024-23900","published":"2024-01-24","fixed":"822.824.v14451b","kev":false}],"package":"Maven:org.jenkins-ci.plugins:matrix-project"}}