CVE-2022-20615

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Published: Jan 12, 2022
Updated: Oct 26, 2023
CVE: CVE-2022-20615
GHSA: GHSA-vqwg-4v6f-h6x5
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
jenkins / matrix_project	-	1.19.x
oracle / communications_cloud_native_core_automated_test_suite	1.9.0	1.9.0.x
rg.jenkins-ci.plugins / matrix-project	-	1.20

http://www.openwall.com/lists/oss-security/2022/01/12/6
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2017
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerability Database

289,599

CVE-2022-20615