Medium
Security advisory
Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-29036
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:27 UTC · Revision 1
Source evidence
Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
osv:CVE-2022-29036
Complete source record
{
"id": "d657e54bbecba8cb0864da0a8df8fcbb795606fa921a21f9046ed30652fad946",
"url": "https://osv.dev/vulnerability/CVE-2022-29036",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-29036",
"summary": "Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.",
"evidence": "osv:CVE-2022-29036",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-29036",
"aliases": [
"CVE-2022-29036",
"GHSA-rvg5-f5fj-mxvg"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jenkinsci/credentials-plugin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b51678df97ac5f8bc35eda36a48795f8530da041"
},
{
"introduced": "1346ba467ba12df2f6784dbb99dd9721994f7fb5"
},
{
"fixed": "39c30cecb0e2512c4e0199e37821025af6e6e070"
},
{
"introduced": "b4e24ac78b811901d635b7c382cdcf50562a63d5"
},
{
"fixed": "c87b7a3597f63aa525d3655bb8270d584ea5fc36"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.6.1.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "1055.v1346ba467ba1"
},
{
"fixed": "1074.1076.v39c30cecb_0e2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:jenkins:credentials:*:*:*:*:*:jenkins:*:*",
"range": [
{
"introduced": "1105.vb_4e24a_c78b_81"
},
{
"fixed": "1112.vc87b_7a_3597f6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1111.v35a_307992395",
"1074.v60e6c29b_b_44b_",
"1105.vb_4e24a_c78b_81",
"1061.vb_1fceb_58fa_18",
"1055.v1346ba467ba1",
"credentials-2.6.1",
"credentials-2.6",
"credentials-2.5",
"credentials-2.4.1",
"credentials-2.4",
"credentials-2.3.18",
"credentials-2.3.17",
"credentials-2.3.16",
"credentials-2.3.15",
"credentials-2.3.14",
"credentials-2.3.13",
"credentials-2.3.12",
"credentials-2.3.11",
"credentials-2.3.10",
"credentials-2.3.9",
"credentials-2.3.8",
"credentials-2.3.7",
"credentials-2.3.6",
"credentials-2.3.5",
"credentials-2.3.4",
"credentials-2.3.3",
"credentials-2.3.2",
"credentials-2.3.1",
"credentials-2.3.0",
"credentials-2.2.1",
"credentials-2.2.0",
"credentials-2.1.19",
"credentials-2.1.18",
"credentials-2.1.17",
"credentials-2.1.16",
"credentials-2.1.15",
"credentials-2.1.14",
"credentials-2.1.13",
"credentials-2.1.12",
"credentials-2.1.11",
"credentials-2.1.10",
"credentials-2.1.9",
"credentials-2.1.8",
"credentials-2.1.7",
"credentials-2.1.6",
"credentials-2.1.5",
"credentials-2.1.4",
"credentials-2.1.3",
"credentials-2.1.2",
"credentials-2.1.1",
"credentials-2.1.0",
"credentials-2.0.7",
"credentials-2.0.6",
"credentials-2.0.5",
"credentials-2.0.4",
"credentials-2.0.3",
"credentials-2.0.2",
"credentials-2.0.1",
"credentials-2.0",
"credentials-1.28",
"credentials-1.27",
"credentials-1.26",
"credentials-1.25",
"credentials-1.24",
"credentials-1.23",
"credentials-1.22",
"credentials-1.21",
"credentials-1.20",
"credentials-1.19",
"credentials-1.18",
"credentials-1.17",
"credentials-1.16.1",
"credentials-1.16",
"credentials-1.15",
"credentials-1.14",
"credentials-1.13",
"credentials-1.12",
"credentials-1.11",
"credentials-1.10",
"credentials-1.9.4",
"credentials-1.9.3",
"credentials-1.9.2",
"credentials-1.9.1",
"credentials-1.9",
"credentials-1.8.4",
"credentials-1.8.3",
"credentials-1.8.2",
"credentials-1.8.1",
"credentials-1.8",
"credentials-1.7.6",
"credentials-1.7.5",
"credentials-1.7.4",
"credentials-1.7.3",
"credentials-1.7.2",
"credentials-1.7.1",
"credentials-1.7",
"credentials-1.6",
"credentials-1.5",
"credentials-1.4",
"credentials-1.3.1",
"credentials-1.3",
"credentials-1.2",
"credentials-1.1",
"credentials-1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29036.json",
"vanir_signatures": [
{
"id": "CVE-2022-29036-4b41f347",
"digest": {
"threshold": 0.9,
"line_hashes": [
"83727615286348313829675903088563602067",
"54869314089508693882626512649044307084",
"312874980153135320499372257308575480433",
"257581418588421848910458884747290341307",
"6691583686450552339977131195670720405",
"132803057579268369307197705357036269611",
"243787488524581158586499063960850071158",
"328184817662817287907696749228039996112",
"96519729426239633875485433117340688952",
"243437566090217521401495988406898513111",
"28483131562127789577545796955169366628",
"72052839710360307075438765084806698039",
"89666286573407154181176688931677930719",
"229655880802628484206953678104251738460",
"19080391125361095553571203643549901209",
"106617460669940603892167930580359240726",
"221344400089268307001470952589678519040",
"111083240275972725174620794389045579337",
"166682197758268882393125630922601866066",
"161208506955036029422877051217577474865",
"109640926340354571798389626581885071480",
"318026700551472885968166101934376943299",
"95149550346917211170534839442573574186",
"90862824560457193317995517193432962847",
"107363461172924357567756489489241822724",
"339325365198068775232023261210550300877",
"256601009744630766042607834988654084816",
"215964877983795893581214131571523116144",
"97739389802329847652444196880629630593",
"261102295215008467095740750384368972168"
]
},
"source": "https://github.com/jenkinsci/credentials-plugin/commit/c87b7a3597f63aa525d3655bb8270d584ea5fc36",
"target": {
"file": "src/test/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinitionTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2022-29036-9c0c53a2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"83727615286348313829675903088563602067",
"306800675778640274636379015543481394824",
"317487875669070261878963467747004926600",
"206873271075746475143112863932813805918",
"123020493912287335925349348128277274615",
"270066523748029991366803290291676983485",
"29228068631080668101363173117000904750",
"328184817662817287907696749228039996112",
"96519729426239633875485433117340688952",
"243437566090217521401495988406898513111",
"28483131562127789577545796955169366628",
"72052839710360307075438765084806698039",
"89666286573407154181176688931677930719",
"229655880802628484206953678104251738460",
"19080391125361095553571203643549901209",
"106617460669940603892167930580359240726",
"221344400089268307001470952589678519040",
"111083240275972725174620794389045579337",
"166682197758268882393125630922601866066",
"161208506955036029422877051217577474865",
"109640926340354571798389626581885071480",
"318026700551472885968166101934376943299",
"95149550346917211170534839442573574186",
"90862824560457193317995517193432962847",
"107363461172924357567756489489241822724",
"339325365198068775232023261210550300877",
"256601009744630766042607834988654084816",
"215964877983795893581214131571523116144",
"275955670840425320496164063633890336428",
"261102295215008467095740750384368972168"
]
},
"source": "https://github.com/jenkinsci/credentials-plugin/commit/39c30cecb0e2512c4e0199e37821025af6e6e070",
"target": {
"file": "src/test/java/com/cloudbees/plugins/credentials/CredentialsParameterDefinitionTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:31:48Z"
}
}
],
"modified": "2026-10-24T14:31:48.667749663Z",
"provider": "osv",
"references": [
"https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2022-29036",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443777,
"published_at": "2022-04-12T20:15:09.08+00:00"
}