Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2ftm-axhf-gbbd
Vulnerability ID VCID-2ftm-axhf-gbbd
Aliases CVE-2022-29046
GHSA-wpr6-qvcq-8269
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29046.json
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.02317 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.05643 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.05643 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
epss 0.05643 https://api.first.org/data/v1/epss?cve=CVE-2022-29046
cvssv3.1 5.4 http://seclists.org/fulldisclosure/2022/Jul/18
generic_textual MODERATE http://seclists.org/fulldisclosure/2022/Jul/18
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wpr6-qvcq-8269
cvssv3.1 5.4 https://github.com/jenkinsci/subversion-plugin
generic_textual MODERATE https://github.com/jenkinsci/subversion-plugin
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-29046
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-29046
cvssv3.1 5.4 https://support.apple.com/kb/HT213345
generic_textual MODERATE https://support.apple.com/kb/HT213345
cvssv3.1 5.4 https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29046.json
https://api.first.org/data/v1/epss?cve=CVE-2022-29046
http://seclists.org/fulldisclosure/2022/Jul/18
https://github.com/jenkinsci/subversion-plugin
https://support.apple.com/kb/HT213345
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
2074851 https://bugzilla.redhat.com/show_bug.cgi?id=2074851
CVE-2022-29046 https://nvd.nist.gov/vuln/detail/CVE-2022-29046
GHSA-wpr6-qvcq-8269 https://github.com/advisories/GHSA-wpr6-qvcq-8269
RHSA-2022:0871 https://access.redhat.com/errata/RHSA-2022:0871
RHSA-2022:1600 https://access.redhat.com/errata/RHSA-2022:1600
RHSA-2022:2205 https://access.redhat.com/errata/RHSA-2022:2205
RHSA-2022:2280 https://access.redhat.com/errata/RHSA-2022:2280
RHSA-2022:4909 https://access.redhat.com/errata/RHSA-2022:4909
RHSA-2022:4947 https://access.redhat.com/errata/RHSA-2022:4947
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29046.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://seclists.org/fulldisclosure/2022/Jul/18
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/jenkinsci/subversion-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29046
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://support.apple.com/kb/HT213345
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.26487
EPSS Score 0.00096
Published At April 24, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:49.157069+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/subversion/CVE-2022-29046.yml 38.0.0