XML External Entity Reference in Jenkins Storable Configs Plugin

2022-05-1800:00:42

CWE-611

GitHub Advisory Database

github.com

0.001 Low

EPSS

Percentile

42.6%

JSON

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

CPENameOperatorVersion
org.jvnet.hudson.plugins:storable-configs-pluginle1.0

CPE	Name	Operator	Version
	org.jvnet.hudson.plugins:storable-configs-plugin	le	1.0

References

github.com/advisories/GHSA-wqmp-2p5r-rhfv

nvd.nist.gov/vuln/detail/CVE-2022-30971

www.jenkins.io/security/advisory/2022-05-17/#SECURITY-1969

0.001 Low

EPSS

Percentile

42.6%

JSON

Related for GHSA-WQMP-2P5R-RHFV