CVE-2022-29040 is a stored cross-site scripting (XSS) vulnerability in Jenkins Git Parameter Plugin versions 0.9.15 and earlier, affecting Jenkins instances utilizing this plugin. The vulnerability allows attackers with Item/Configure permission to inject malicious scripts into Git parameter names and descriptions, which are then executed when viewed by other users. With a CVSS score of 5.4 (Medium), exploitation requires low privileges and user interaction, potentially leading to limited impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.9.15CPE matchmatch criteria | cpe:2.3:a:jenkins:git_parameter:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.