CVE-2022-27201

The CVE-2022-27201 entry affects Jenkins Semantic Versioning Plugin, version 1.13 and earlier. The root cause is that the plugin does not restrict execution of a controller/agent message to agents and imposes no limits on the file path that can be parsed, enabling crafted files that leverage exte...

CVE-2023-24429

CVE-2023-24429 affects Jenkins Plugin: Semantic Versioning Plugin (versions ≤ 1.14). Root cause: XML parsing of a crafted controller/agent message that allows XML external entity (XXE) processing, enabling exfiltration of secrets from the Jenkins controller or triggering server-side requests. Imp...

CVE-2023-24430

CVE-2023-24430 affects Jenkins Semantic Versioning Plugin 1.14 and earlier, where the XML parser is not configured to prevent XML external entity (XXE) attacks. This XXE flaw could enable an attacker able to influence agent/controller parsing to exfiltrate data or affect processing. The issue is ...