CVE-2022-29037: 
Java vulnerability analysis and mitigation

Jenkins CVS Plugin 2.19 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2022-29037) that was disclosed on April 12, 2022. The vulnerability affects the CVS Symbolic Name parameters functionality, where the plugin fails to properly escape the name and description of parameters on views displaying parameters (Jenkins Advisory, NVD).

The vulnerability stems from improper neutralization of input during web page generation, specifically in the handling of CVS Symbolic Name parameters. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows attackers with Item/Configure permission to perform stored cross-site scripting attacks. The exploitation requires that parameters are listed on another page, such as the 'Build With Parameters' and 'Parameters' pages provided by Jenkins core (Jenkins Advisory).

The vulnerability was fixed in CVS Plugin version 2.19.1. Users of affected versions should upgrade to this version to mitigate the vulnerability. The fix involves properly escaping the name and description of the parameter types provided by the plugin (Jenkins Advisory).