Stored XSS vulnerability in Matrix Project Plugin

MEDIUM 5.4CVE-2022-20615 · GHSA-vqwg-4v6f-h6x5 · Published 12/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:matrix-project Maven	`≥ 1.19, < 1.20< 1.18.1`	`1.201.18.1`
matrix project jenkins	`≤ 1.19`	No fix yet
communications cloud native core automated test suite oracle	`= 1.9.0`	No fix yet

Description

Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.

NVD description

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

References

nvd.nist.gov/vuln/detail/CVE-2022-20615 · ADVISORY
jenkinsci/matrix-project-plugin commit 78cc605 · WEB
CVEProject/cvelist · WEB
jenkinsci/matrix-project-plugin · PACKAGE
jenkins.io/security/advisory/2022-01-12 · WEB
oracle.com/security-alerts/cpuapr2022.html · WEB
openwall.com/lists/oss-security/2022/01/12/6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free