Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-u4r3-mm95-nbe3
Vulnerability ID VCID-u4r3-mm95-nbe3
Aliases CVE-2022-29041
GHSA-m3p3-2gp6-ghq8
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29041.json
epss 0.00217 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.00217 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.00217 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
epss 0.0811 https://api.first.org/data/v1/epss?cve=CVE-2022-29041
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-m3p3-2gp6-ghq8
cvssv3.1 5.4 https://github.com/jenkinsci/jira-plugin
generic_textual MODERATE https://github.com/jenkinsci/jira-plugin
cvssv3.1 5.4 https://github.com/jenkinsci/jira-plugin/commit/e1eed0d64b4e32ce84946d632dab76c3f0ff6c4e
generic_textual MODERATE https://github.com/jenkinsci/jira-plugin/commit/e1eed0d64b4e32ce84946d632dab76c3f0ff6c4e
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-29041
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-29041
cvssv3.1 5.4 https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
generic_textual MODERATE https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29041.json
https://api.first.org/data/v1/epss?cve=CVE-2022-29041
https://github.com/jenkinsci/jira-plugin
https://github.com/jenkinsci/jira-plugin/commit/e1eed0d64b4e32ce84946d632dab76c3f0ff6c4e
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
2074850 https://bugzilla.redhat.com/show_bug.cgi?id=2074850
CVE-2022-29041 https://nvd.nist.gov/vuln/detail/CVE-2022-29041
GHSA-m3p3-2gp6-ghq8 https://github.com/advisories/GHSA-m3p3-2gp6-ghq8
RHSA-2022:1600 https://access.redhat.com/errata/RHSA-2022:1600
RHSA-2022:2205 https://access.redhat.com/errata/RHSA-2022:2205
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29041.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/jenkinsci/jira-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/jenkinsci/jira-plugin/commit/e1eed0d64b4e32ce84946d632dab76c3f0ff6c4e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29041
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.44175
EPSS Score 0.00217
Published At April 24, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:48.729347+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins/jira/CVE-2022-29041.yml 38.0.0