CVE-2022-29046: 
Java vulnerability analysis and mitigation

Jenkins Subversion Plugin version 2.15.3 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2022-29046). The vulnerability exists because the plugin does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters. This vulnerability was discovered and reported by Evgeny Kotkov from visualsvn.com and was disclosed on April 12, 2022 (Jenkins Advisory).

The vulnerability is a stored cross-site scripting (XSS) issue that occurs due to improper escaping of parameter names and descriptions in the List Subversion tags functionality. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers with Item/Configure permission to perform stored cross-site scripting attacks. The exploitation requires that parameters are listed on another page, such as the 'Build With Parameters' and 'Parameters' pages provided by Jenkins core (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Item/Configure permission in Jenkins. However, Jenkins core has prevented exploitation of vulnerabilities of this kind on the 'Build With Parameters' and 'Parameters' pages since versions 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix (Jenkins Advisory).

The vulnerability was fixed in Jenkins Subversion Plugin version 2.15.4. Users should upgrade to this version or later to address the security issue. The fix involves properly escaping the name and description of the parameter types provided by the plugin (Jenkins Advisory).