CVE-2022-20615

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Matrix Project Plugin	>= unspecified, <= 1.19

References

http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2017Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2017Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-206164.3Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing a CVE-2022-206178.8Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnera CVE-2022-206184.3A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access CVE-2022-206197.1A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers t CVE-2022-20627.5Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-206204.3Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials ID CVE-2022-206215.5Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where CVE-2022-206227.5A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow a CVE-2022-206237.5A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series CVE-2022-206247.5A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacke CVE-2022-206254.3A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adja CVE-2022-206265.4A vulnerability in the web-based management interface of Cisco Prime Access Registrar Appliance could allow an authenticated, remote at