PT-2022-20428 · Jenkins · Jenkins Storable Configs Plugin+1

Daniel Beck · Published 2022-05-17 · Updated 2023-11-03 · CVE-2022-30971

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Storable Configs Plugin versions 1.0 and earlier

Description The issue arises from the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks. This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Recommendations For Jenkins Storable Configs Plugin versions 1.0 and earlier, consider disabling the XML parser configuration until a patch is available to prevent XXE attacks. Restrict access to the plugin's configuration to minimize the risk of exploitation. Avoid using the plugin to parse crafted files that may contain external entities until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-30971

GHSA-WQMP-2P5R-RHFV

Affected Products

Jenkins

Jenkins Storable Configs Plugin

References · 6

• https://jenkins.io/security/advisory/2022-05-17/#SECURITY-1969 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqmp-2p5r-rhfv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30971 · Security Note
• https://github.com/jenkinsci/storable-configs-plugin · Note
• https://t.me/cvenotify/30312 · Telegram Post