Patchfirst
Patchfirst
CVE-2022-29036 EPSS 71.9%

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4…

Jenkins project · Jenkins Credentials Plugin

Summary

The Jenkins Credentials Plugin, in versions 1111.v35a_307992395 and earlier (excluding several specified fixed releases), fails to escape the name and description of Credentials parameters on pages that display them, creating a stored cross-site scripting flaw.

Official description · CVE.org

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Breakdown
19.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 12 Apr 2022. No public exploit code or confirmed exploitation is recorded.

5 fixes in credentials over 6 years. The latest fix listed for credentials is 1381.v2c3a.

Fixes in credentialsMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.1.17CVE-2018-100060126 Jun 2018
  2. 2.1.19CVE-2019-1032021 May 2019
  3. 2.3.19CVE-2021-2164811 May 2021
  4. 1087.1089.v2f1b_9a_b_040e4CVE-2022-2903612 Apr 2022
  5. 1381.v2c3aCVE-2024-478052 Oct 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:credentials.

Mavenorg.jenkins-ci.plugins:credentialsGHSA-rvg5-f5fj-mxvg

Upgrade to 2.6.1.1

Also affected, despite being newer: 1105 through 1111.v35a; 1087.v16065d268466 up to 1087.1089.v2f1b_9a_b_040e4; 2.6.2 up to 1074.1076.v39c30cecb_0e2.

Set the version to 2.6.1.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2022-29036. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
1105 through 1111.v35aNo fix published
1087.v16065d268466 up to 1087.1089.v2f1b_9a_b_040e41087.1089.v2f1b_9a_b_040e4
2.6.2 up to 1074.1076.v39c30cecb_0e21074.1076.v39c30cecb_0e2
All versions before 2.6.1.12.6.1.1

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

Other 1

jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
↑ ↓ chooseEnter openEsc close