Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2jak-uh1e-zbfx
Vulnerability ID VCID-2jak-uh1e-zbfx
Aliases CVE-2022-29036
GHSA-rvg5-f5fj-mxvg
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29036.json
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.00355 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
epss 0.03963 https://api.first.org/data/v1/epss?cve=CVE-2022-29036
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rvg5-f5fj-mxvg
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-29036
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-29036
cvssv3.1 5.4 https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29036.json
https://api.first.org/data/v1/epss?cve=CVE-2022-29036
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
2074847 https://bugzilla.redhat.com/show_bug.cgi?id=2074847
CVE-2022-29036 https://nvd.nist.gov/vuln/detail/CVE-2022-29036
GHSA-rvg5-f5fj-mxvg https://github.com/advisories/GHSA-rvg5-f5fj-mxvg
RHSA-2022:0871 https://access.redhat.com/errata/RHSA-2022:0871
RHSA-2022:1600 https://access.redhat.com/errata/RHSA-2022:1600
RHSA-2022:2205 https://access.redhat.com/errata/RHSA-2022:2205
RHSA-2022:2280 https://access.redhat.com/errata/RHSA-2022:2280
RHSA-2022:4909 https://access.redhat.com/errata/RHSA-2022:4909
RHSA-2022:4947 https://access.redhat.com/errata/RHSA-2022:4947
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29036.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29036
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57777
EPSS Score 0.00355
Published At April 24, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:48.601012+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/credentials/CVE-2022-29036.yml 38.0.0