Medium severity5.4NVD Advisory· Published Apr 12, 2022· Updated Jun 17, 2026

CVE-2022-29046

Description

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:subversionMaven	< 2.15.4	2.15.4

Affected products

Jenkins Project/Subversion
cpe:2.3:a:jenkins:subversion:*:*:*:*:*:jenkins:*:*
Range: <=2.15.3
Apple Inc./macOS
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Range: >=12.0,<12.5
ghsa-coords
pkg:maven/org.jenkins-ci.plugins/subversion
Range: < 2.15.4
Jenkins Project/Subversion Plugincpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2022/Jul/18nvdMailing ListThird Party AdvisoryWEB
github.com/advisories/GHSA-wpr6-qvcq-8269ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-29046ghsaADVISORY
support.apple.com/kb/HT213345nvdThird Party AdvisoryWEB
www.jenkins.io/security/advisory/2022-04-12/nvdVendor AdvisoryWEB

News mentions

Jenkins Security Advisory 2022-04-12
Jenkins Security Advisories · Apr 12, 2022

cvss	0.351
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000