CVE-2022-45396 - Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

CRITICAL

Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

Published Nov 15, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.02%

Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<=0.2

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/11/15/4		mailing-listMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7355		Advisory
https://github.com/advisories/GHSA-h4wx-78p9-fwxw		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45396
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2927		Vendor Advisory