CVE-2022-20615

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored…

published January 12, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS
—
EPSS
82%
Percentile
99.6
In the wild
Unconfirmed
What it is

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.81842 · 99.6th percentile
Published
2022-01-12T19:05Z
EPSS history
Timeline
  • 12 JAN 19:05Z
    Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored…
    cvelistv5