GCVE - cpe:2.3:a:jenkins:promoted_builds:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:promoted_builds:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Promoted Builds (`ed5b0139-a734-5cd1-b76c-58f858ef1aa7`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/jenkinsci/promoted-builds-plugin`	purl2cpe	2026-06-01 10:14:15.885083

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-30965`	vulnerable	2026-06-08 05:43:39.894413	Details available Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Published: 2022-05-17T14:06:45.000Z Updated: 2024-08-03T07:03:39.922Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29049`	vulnerable	2026-06-08 05:42:46.368954	Details available Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name. Published: 2022-04-12T00:00:00.000Z Updated: 2024-08-03T06:10:58.886Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2655	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29045`	vulnerable	2026-06-08 05:42:46.363364	Details available Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Published: 2022-04-12T00:00:00.000Z Updated: 2024-08-03T06:10:59.348Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-21641`	vulnerable	2026-06-08 05:29:13.068634	Details available A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds. Published: 2021-04-07T13:50:15.000Z Updated: 2024-10-15T17:14:47.328Z Open on db.gcve.eu Reference links https://www.jenkins.io/security/advisory/2021-04-07/#SECURITY-2293 http://www.openwall.com/lists/oss-security/2021/04/07/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1000114`	vulnerable	2026-06-08 05:10:25.448059	Details available An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attacker with read access to jobs to perform promotions. Published: 2018-03-13T13:00:00.000Z Updated: 2024-09-16T23:16:12.603Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2018-02-26/#SECURITY-746	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.