CVE-2022-29046
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-29046- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-29046- Updated
- 2026-11-02
EUVDEUVD-2022-1859 No score
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
EUVD-2022-1859- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wpr6-qvcq-8269
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Exploitation of this vulnerability requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the "Build With Parameters" and "Parameters" pages since 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix.
- Record
GHSA-wpr6-qvcq-8269- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Record
CVE-2022-29046- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-wpr6-qvcq-8269
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Exploitation of this vulnerability requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the "Build With Parameters" and "Parameters" pages since 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix.
- Record
GHSA-wpr6-qvcq-8269- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2022:0871
Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update
- Record
RHSA-2022:0871- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:1600
Red Hat Security Advisory: OpenShift Container Platform 4.10.12 security update
- Record
RHSA-2022:1600- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2022:2205
Red Hat Security Advisory: OpenShift Container Platform 4.9.33 packages and security update
- Record
RHSA-2022:2205- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2022:2280
Red Hat Security Advisory: OpenShift Container Platform 3.11.705 security update
- Record
RHSA-2022:2280- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2022:4909
Red Hat Security Advisory: OpenShift Container Platform 4.7.52 paackages and security update
- Record
RHSA-2022:4909- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2022:4947
Red Hat Security Advisory: OpenShift Container Platform 4.6.59 security update
- Record
RHSA-2022:4947- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:subversionMaven |
before 2.15.4 | 2.15.4 |
org.jenkins-ci.plugins:subversionMaven |
before 2.15.4, plus listed versions 1.241.251.261.281.29 Show 45 moreShow less1.301.311.321.331.341.351.361.371.381.391.401.411.421.431.441.451.481.501.511.531.542.02.0-alpha-12.0-beta-12.12.102.10.12.10.22.10.32.10.42.10.52.10.62.11.02.11.12.12.02.12.12.12.22.13.02.13.12.13.22.14.02.14.12.14.22.14.32.14.4 |
2.15.4 |
cri-oRed Hat:openshift:4.8::el7 From an advisory covering 15 CVEs |
before 0:1.21.5-3.rhaos4.8.gitaf64931.el7 | 0:1.21.5-3.rhaos4.8.gitaf64931.el7 |
cri-o-debuginfoRed Hat:openshift:4.8::el7 From an advisory covering 15 CVEs |
before 0:1.21.5-3.rhaos4.8.gitaf64931.el7 | 0:1.21.5-3.rhaos4.8.gitaf64931.el7 |
cri-oRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:1.21.5-3.rhaos4.8.gitaf64931.el8 | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
cri-o-debuginfoRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:1.21.5-3.rhaos4.8.gitaf64931.el8 | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
cri-o-debugsourceRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:1.21.5-3.rhaos4.8.gitaf64931.el8 | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
jenkins-2-pluginsRed Hat:openshift:4.8::el8 From an advisory covering 15 CVEs |
before 0:4.8.1646993358-1.el8 | 0:4.8.1646993358-1.el8 |
cri-oRed Hat:openshift:4.10::el8 From an advisory covering 4 CVEs |
before 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
cri-o-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 4 CVEs |
before 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cri-o-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 4 CVEs |
before 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 | 0:1.23.2-8.rhaos4.10.git8ad5d25.el8 |
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 4 CVEs |
before 0:4.10.1650890594-1.el8 | 0:4.10.1650890594-1.el8 |
jenkins-2-pluginsRed Hat:openshift:4.9::el8 From an advisory covering 4 CVEs |
before 0:4.9.1651754460-1.el8 | 0:4.9.1651754460-1.el8 |
atomic-openshift-dockerregistryRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.705-1.g0fa231c.el7 | 0:3.11.705-1.g0fa231c.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 3 CVEs |
before 0:3.11.1650628887-1.el7 | 0:3.11.1650628887-1.el7 |
jenkins-2-pluginsRed Hat:openshift:4.7::el8 From an advisory covering 3 CVEs |
before 0:4.7.1652967082-1.el8 | 0:4.7.1652967082-1.el8 |
conmonRed Hat:openshift:4.6::el7 From an advisory covering 3 CVEs |
before 2:2.0.21-3.rhaos4.6.el7 | 2:2.0.21-3.rhaos4.6.el7 |
cri-oRed Hat:openshift:4.6::el7 From an advisory covering 3 CVEs |
before 0:1.19.7-2.rhaos4.6.git3c20b65.el7 | 0:1.19.7-2.rhaos4.6.git3c20b65.el7 |
cri-o-debuginfoRed Hat:openshift:4.6::el7 From an advisory covering 3 CVEs |
before 0:1.19.7-2.rhaos4.6.git3c20b65.el7 | 0:1.19.7-2.rhaos4.6.git3c20b65.el7 |
conmonRed Hat:openshift:4.6::el8 From an advisory covering 3 CVEs |
before 2:2.0.21-3.rhaos4.6.el8 | 2:2.0.21-3.rhaos4.6.el8 |
cri-oRed Hat:openshift:4.6::el8 From an advisory covering 3 CVEs |
before 0:1.19.7-2.rhaos4.6.git3c20b65.el8 | 0:1.19.7-2.rhaos4.6.git3c20b65.el8 |
cri-o-debuginfoRed Hat:openshift:4.6::el8 From an advisory covering 3 CVEs |
before 0:1.19.7-2.rhaos4.6.git3c20b65.el8 | 0:1.19.7-2.rhaos4.6.git3c20b65.el8 |
cri-o-debugsourceRed Hat:openshift:4.6::el8 From an advisory covering 3 CVEs |
before 0:1.19.7-2.rhaos4.6.git3c20b65.el8 | 0:1.19.7-2.rhaos4.6.git3c20b65.el8 |
jenkins-2-pluginsRed Hat:openshift:4.6::el8 From an advisory covering 3 CVEs |
before 0:4.6.1653312933-1.el8 | 0:4.6.1653312933-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-29046 is a medium vulnerability (CVSS 5.4) in Jenkins Subversion, published April 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in org.jenkins-ci.plugins:subversion 2.15.4.
References
jenkins.io/security/advisory/2022-04-12
support.apple.com/kb/HT213345
seclists.org/fulldisclosure/2022/Jul/18
nvd.nist.gov/vuln/detail/CVE-2022-29046
github.com/advisories/GHSA-wpr6-qvcq-8269
Show 100 moreShow less
access.redhat.com/errata/RHSA-2022:0871
bugzilla.redhat.com/show_bug.cgi?id=2059475
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0871.json
cve.org/CVERecord?id=CVE-2022-0811
Left out here: 31 versions. The JSON record has them.