Lucene search

[email protected]CVE-2023-24443

HistoryJan 26, 2023 - 9:18 p.m.

CVE-2023-24443

2023-01-2621:18:18

CWE-611

[email protected]

web.nvd.nist.gov

cve-2023-24443

jenkins

testcomplete

plugin

xml-parser

xxe

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.9%

JSON

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CPENameOperatorVersion
jenkins:testcomplete_supportjenkins testcomplete supportle2.8.1
jenkins:testcomplete_supportjenkins testcomplete supporteq2.0
jenkins:testcomplete_supportjenkins testcomplete supporteq-
jenkins:testcomplete_supportjenkins testcomplete supporteq1.7
jenkins:testcomplete_supportjenkins testcomplete supporteq1.11
jenkins:testcomplete_supportjenkins testcomplete supporteq2.3
jenkins:testcomplete_supportjenkins testcomplete supporteq2.2
jenkins:testcomplete_supportjenkins testcomplete supporteq1.3
jenkins:testcomplete_supportjenkins testcomplete supporteq2.5.1
jenkins:testcomplete_supportjenkins testcomplete supporteq2.7

CPE	Name	Operator	Version
jenkins:testcomplete_support	jenkins testcomplete support	le	2.8.1
jenkins:testcomplete_support	jenkins testcomplete support	eq	2.0
jenkins:testcomplete_support	jenkins testcomplete support	eq	-
jenkins:testcomplete_support	jenkins testcomplete support	eq	1.7
jenkins:testcomplete_support	jenkins testcomplete support	eq	1.11
jenkins:testcomplete_support	jenkins testcomplete support	eq	2.3
jenkins:testcomplete_support	jenkins testcomplete support	eq	2.2
jenkins:testcomplete_support	jenkins testcomplete support	eq	1.3
jenkins:testcomplete_support	jenkins testcomplete support	eq	2.5.1
jenkins:testcomplete_support	jenkins testcomplete support	eq	2.7

Rows per page:

1-10 of 281

References

www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2741

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.9%

JSON

Related for CVE-2023-24443

prion1 cvelist1 osv2 github1 nessus2