CVE-2022-29036

Deeper analysis

The Jenkins Credentials Plugin in versions 1111.v35a_307992395 and earlier, excluding the listed backports, contains a stored cross-site scripting flaw tracked as CVE-2022-29036. The root cause is missing output encoding for the name and description fields of Credentials parameters when those values are rendered on parameter-display views, allowing attacker-controlled markup to be stored and later executed in other users' browsers.

An attacker who already possesses Item/Configure permission on a Jenkins item can supply a malicious name or description for a Credentials parameter; any user who subsequently views the parameter page will execute the injected script in the context of the Jenkins controller, resulting in limited impacts to confidentiality and integrity as reflected in the CVSS 5.4 score.

The official Jenkins security advisory published on 2022-04-12 recommends upgrading the Credentials Plugin to a fixed release and notes that the issue was addressed by properly escaping the affected fields.

EPSS for this CVE rose from a low baseline to a peak of 0.1635 on 2025-12-11 before receding to the current value of 0.0036, indicating that exploitation interest increased well after the original disclosure.