CVE-2022-20615

2022-01-1220:15:08

Google

osv.dev

0.001 Low

EPSS

Percentile

40.5%

JSON

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

CPENameOperatorVersion
matrix-project-plugineqmatrix-project-1.13
matrix-project-plugineqmatrix-project-1.19
matrix-project-plugineqmatrix-project-1.6
matrix-project-plugineqmatrix-project-1.17
matrix-project-plugineqmatrix-project-1.0-beta-1
matrix-project-plugineqmatrix-project-1.14
matrix-project-plugineqmatrix-project-1.12
matrix-project-plugineqmatrix-project-1.7
matrix-project-plugineqmatrix-project-1.18
matrix-project-plugineqmatrix-project-1.15

Name	Operator	Version
matrix-project-plugin	eq	matrix-project-1.13
matrix-project-plugin	eq	matrix-project-1.19
matrix-project-plugin	eq	matrix-project-1.6
matrix-project-plugin	eq	matrix-project-1.17
matrix-project-plugin	eq	matrix-project-1.0-beta-1
matrix-project-plugin	eq	matrix-project-1.14
matrix-project-plugin	eq	matrix-project-1.12
matrix-project-plugin	eq	matrix-project-1.7
matrix-project-plugin	eq	matrix-project-1.18
matrix-project-plugin	eq	matrix-project-1.15