CVE-2022-36905

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

• CWE-79

• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686Vendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3690The Popup Maker WordPress plugin before 1.16.11 does not san…4.8
• CVE-2022-36900Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does…8.2
• CVE-2022-36901Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Req…6.5
• CVE-2022-36902Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and e…5.4
• CVE-2022-36903A missing permission check in Jenkins Repository Connector P…4.3
• CVE-2022-36904Jenkins Repository Connector Plugin 2.2.0 and earlier does n…4.3
• CVE-2022-36906A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2022-36907A missing permission check in Jenkins OpenShift Deployer Plu…6.5
• CVE-2022-36908A cross-site request forgery (CSRF) vulnerability in Jenkins…6.5
• CVE-2022-36909A missing permission check in Jenkins OpenShift Deployer Plu…6.5
• CVE-2022-3691The DeepL Pro API translation plugin WordPress plugin before…7.5
• CVE-2022-36910Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier d…5.4