{"id":"CVE-2022-29036","published":"2022-04-12T00:00:00Z","modified":"2024-08-03T06:10:58Z","title":"Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…","vendor":"Jenkins project","product":"Jenkins Credentials Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Credentials Plugin","versions":[">= unspecified, <= 1111.v35a_307992395"]}],"description":{"text":"Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins Credentials Plugin, in versions 1111.v35a_307992395 and earlier (excluding several specified fixed releases), fails to escape the name and description of Credentials parameters on pages that display them, creating a stored cross-site scripting flaw.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:27Z"},"cvss":null,"epss":{"score":0.71926,"percentile":0.99426,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":["<2.6.1.1",">=2.6.2, <1074.1076.v39c30cecb_0e2",">=1087.v16065d268466, <1087.1089.v2f1b_9a_b_040e4",">=1105, <=1111.v35a"],"patched":["2.6.1.1","1074.1076.v39c30cecb_0e2","1087.1089.v2f1b_9a_b_040e4"],"from":["GHSA-rvg5-f5fj-mxvg"],"provenance":"source"}],"advisories":[{"id":"GHSA-rvg5-f5fj-mxvg","url":"https://github.com/advisories/GHSA-rvg5-f5fj-mxvg","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":["<2.6.1.1"],"patched":["2.6.1.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rvg5-f5fj-mxvg","url":"https://github.com/advisories/GHSA-rvg5-f5fj-mxvg","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":[">=2.6.2, <1074.1076.v39c30cecb_0e2"],"patched":["1074.1076.v39c30cecb_0e2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rvg5-f5fj-mxvg","url":"https://github.com/advisories/GHSA-rvg5-f5fj-mxvg","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":[">=1087.v16065d268466, <1087.1089.v2f1b_9a_b_040e4"],"patched":["1087.1089.v2f1b_9a_b_040e4"],"provenance":"source","from":"GHSA"},{"id":"GHSA-rvg5-f5fj-mxvg","url":"https://github.com/advisories/GHSA-rvg5-f5fj-mxvg","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:credentials","vulnerableRanges":[">=1105, <=1111.v35a"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1827","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1827","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-29036","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9943"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-1000601","published":"2018-06-26","fixed":"2.1.17","kev":false},{"cve":"CVE-2019-10320","published":"2019-05-21","fixed":"2.1.19","kev":false},{"cve":"CVE-2021-21648","published":"2021-05-11","fixed":"2.3.19","kev":false,"link":{"from":"CVE-2021-21648","to":"CVE-2022-29036","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:credentials","fromFixed":"2.3.19","toFixed":"2.6.1.1","daysApart":336}]}},{"cve":"CVE-2022-29036","published":"2022-04-12","fixed":"1087.1089.v2f1b_9a_b_040e4","kev":false},{"cve":"CVE-2024-47805","published":"2024-10-02","fixed":"1381.v2c3a","kev":false}],"package":"Maven:org.jenkins-ci.plugins:credentials"}}