{"id":"CVE-2022-29049","aliases":["EUVD-2022-1775","GHSA-jmxr-w2jc-qp7w"],"status":"published","title":"Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL","description":"Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00816,"percentile":0.57397,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-79"],"published":"2022-04-12T00:00:00Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:promoted-builds","fixed_in":["3.10.1","876.v99d29788b"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:promoted-builds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:promoted-builds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11"},{"fixed":"876.v99d29788b"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:promoted-builds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.1"}]}],"versions":["2.0","2.1","2.10","2.11","2.12","2.13","2.14","2.15","2.16","2.17","2.18","2.19","2.2","2.20","2.21","2.22","2.22-beta1","2.23","2.23.1","2.24","2.24.1","2.25","2.26","2.27","2.28","2.28.1","2.29","2.29.1","2.3","2.3.1","2.30","2.31","2.31.1","2.4","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.9","3.0","3.1","3.10","3.2","3.3","3.4","3.5","3.5.1","3.6","3.7","3.9","3.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:promoted-builds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11"},{"fixed":"876.v99d29788b"}]}],"versions":["3.11","867.v7c3a_b_83a_eb_79","873.v6149db_d64130"]}],"products":[{"vendor":"jenkins","product":"promoted_builds"},{"vendor":"jenkins project","product":"jenkins promoted builds plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2655","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29049","tags":["advisory"]},{"url":"https://github.com/jenkinsci/promoted-builds-plugin/commit/d6fd95688ae2052bf9ac7158bc2579c755167fe0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jmxr-w2jc-qp7w"},{"url":"https://github.com/jenkinsci/promoted-builds-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-29049","description":"Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.","status":"published","published":"2022-04-12T00:00:00Z","modified":"2024-08-03T06:10:58.886Z","updated_at":"2026-11-02T14:34:36.270817Z"}],"euvd":[{"id":"EUVD-2022-1775","description":"Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.","status":"published","published":"2022-04-12T00:00:00Z","modified":"2024-08-03T06:10:58Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-jmxr-w2jc-qp7w","title":"Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL","description":"Jenkins promoted builds Plugin provides dedicated support for defining promotions using [Job DSL Plugin](https://plugins.jenkins.io/job-dsl).\n\npromoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other `config.xml` files.\n\npromoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.","status":"published","published":"2022-04-13T00:00:16Z","modified":"2023-07-21T19:28:29Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2022-29049","description":"Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.","status":"published","published":"2022-04-12T20:15:09.713Z","modified":"2026-06-17T04:39:30.253Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:15.414503Z"}],"osv":[{"id":"CVE-2022-29049","description":"Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.","status":"published","published":"2022-04-12T20:15:09.713Z","modified":"2026-10-24T10:30:42.07081001Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GHSA-jmxr-w2jc-qp7w","title":"Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL","description":"Jenkins promoted builds Plugin provides dedicated support for defining promotions using [Job DSL Plugin](https://plugins.jenkins.io/job-dsl).\n\npromoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other `config.xml` files.\n\npromoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.","status":"published","published":"2022-04-13T00:00:16Z","modified":"2024-02-16T08:15:40.16033Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-79"],"updated_at":"2026-11-02T15:46:50.687609Z"}]}}