CVE-2022-29043: 
Java vulnerability analysis and mitigation

Jenkins Mask Passwords Plugin 3.0 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2022-29043) that was disclosed on April 12, 2022. The vulnerability affects the plugin's handling of Non-Stored Password parameters, specifically in how it displays parameter names and descriptions on parameter views (Jenkins Advisory, NVD).

The vulnerability stems from the plugin's failure to properly escape the name and description of Non-Stored Password parameters when they are displayed on views. This vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows attackers with Item/Configure permission to execute stored cross-site scripting (XSS) attacks through the parameter name and description fields. The impact is limited to scenarios where parameters are listed on pages like 'Build With Parameters' and 'Parameters' pages, and these pages are not hardened against such attacks (Jenkins Advisory).

The vulnerability has been fixed in Mask Passwords Plugin version 3.1. Users are strongly advised to upgrade to this version to address the security issue. The fix involves properly escaping the name and description of parameter types provided by the plugin (Jenkins Advisory).