CVE-2022-29046: Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Summary
CVE-2022-29046: Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin. Affects org.jenkins-ci.plugins:subversion versions < 2.15.4. Fixed in 2.15.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Subversion Plugin is a Maven package (org.jenkins-ci.plugins:subversion) that provides integration with the Subversion version control system. It allows Jenkins users to configure and manage Subversion repositories, branches, and tags within their Jenkins pipelines. This plugin is widely used in software development environments that utilize Subversion for version control.
Vulnerability Detail
The Jenkins Subversion Plugin version 2.15.3 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape the name and description of List Subversion tags parameters when displayed on views that show parameters. This vulnerability can be exploited by attackers with Item/Configure permission. To exploit this vulnerability, the parameters must be listed on pages like 'Build With Parameters' and 'Parameters' in Jenkins (core) that are not hardened against XSS attacks. Jenkins (core) has addressed similar vulnerabilities in the 'Build With Parameters' and 'Parameters' pages since version 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix.
How To Fix
Latest published version: 1327.vc36e0019a_653 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the plugin is not immediately feasible, a temporary workaround is to harden the 'Build With Parameters' and 'Parameters' pages in Jenkins (core) to prevent XSS attacks. This can be done by applying the SECURITY-353 / CVE-2017-2601 fix to Jenkins (core) version 2.44 or later.
Conclusion
The Jenkins Subversion Plugin version 2.15.3 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. It is crucial to upgrade to version 2.15.4 or later to mitigate this vulnerability. If immediate upgrading is not possible, hardening the 'Build With Parameters' and 'Parameters' pages in Jenkins (core) can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:subversion →
FAQ
Stored XSS is a type of cross-site scripting vulnerability where the malicious script is permanently stored on the target server, such as in a database or file. When a user accesses the vulnerable page, the script is executed, allowing the attacker to steal sensitive information or perform actions on behalf of the user.
Attackers with Item/Configure permission in Jenkins can exploit this vulnerability. They can manipulate the name and description of List Subversion tags parameters to inject malicious scripts, which will be executed when the parameters are displayed on vulnerable pages.
Exploiting this vulnerability can lead to various consequences, including unauthorized access to sensitive information, session hijacking, defacement of Jenkins views, and potential further attacks on users or systems interacting with the compromised Jenkins instance.
Yes, Jenkins (core) has previously addressed vulnerabilities of this kind in the 'Build With Parameters' and 'Parameters' pages. The fix for SECURITY-353 / CVE-2017-2601, implemented in Jenkins (core) version 2.44 and LTS 2.32.2, prevents the exploitation of XSS vulnerabilities in parameter names and descriptions.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:subversion.
