CVE-2022-29042

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-12 · updated 2026-06-17
Weakness: CWE-79

Description

Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products

Jenkins project Jenkins Job Generator Plugin: through 1.22

References

https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617

Get alerted when CVE-2022-29042 or the next vulnerability affects your stack