What is CVE-2022-36905?

CVE-2022-36905 is a medium-severity vulnerability in Jenkins Maven Metadata, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-07-27.

How severe is CVE-2022-36905?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Jenkins Maven Metadata

CVE-2022-36905

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Jenkins Maven_metadata
Jenkins Project Maven Metadata Plugin For Ci Server — versions unspecified, next of 2.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

jenkinsci-cert@googlegroups.com (x_refsource_CONFIRM, Vendor Advisory)
jenkinsci-cert@googlegroups.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2022-36905?: CVE-2022-36905 is a medium-severity vulnerability in Jenkins Maven Metadata, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-07-27.
How severe is CVE-2022-36905?: Medium severity. CVSS v3 base score is 5.4 out of 10.