CVE-2022-29039

2022-04-1220:15:09

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
gerrit-trigger-plugineqgerrit-trigger-2.32.0
gerrit-trigger-plugineqgerrit-trigger-2.12.0
gerrit-trigger-plugineqgerrit-trigger-2.30.3
gerrit-trigger-plugineqgerrit-trigger-2.27.4
gerrit-trigger-plugineqgerrit-trigger-2.3.0
gerrit-trigger-plugineqgerrit-trigger-2.13.0
gerrit-trigger-plugineqgerrit-trigger-2.35.2
gerrit-trigger-plugineqgerrit-trigger-2.26.1
gerrit-trigger-plugineqgerrit-trigger-2.21.1
gerrit-trigger-plugineqgerrit-trigger-2.14.0

Name	Operator	Version
gerrit-trigger-plugin	eq	gerrit-trigger-2.32.0
gerrit-trigger-plugin	eq	gerrit-trigger-2.12.0
gerrit-trigger-plugin	eq	gerrit-trigger-2.30.3
gerrit-trigger-plugin	eq	gerrit-trigger-2.27.4
gerrit-trigger-plugin	eq	gerrit-trigger-2.3.0
gerrit-trigger-plugin	eq	gerrit-trigger-2.13.0
gerrit-trigger-plugin	eq	gerrit-trigger-2.35.2
gerrit-trigger-plugin	eq	gerrit-trigger-2.26.1
gerrit-trigger-plugin	eq	gerrit-trigger-2.21.1
gerrit-trigger-plugin	eq	gerrit-trigger-2.14.0