PT-2022-27488 · Jenkins · Jenkins Violations Plugin+1

Daniel Beck · Published 2022-11-15 · Updated 2023-11-01 · CVE-2022-45386

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Violations Plugin versions 0.7.11 and earlier

Description The issue arises from the Jenkins Violations Plugin not configuring its XML parser to prevent XML external entity (XXE) attacks. This allows attackers to control XML input files for the 'Report Violations' post-build step, potentially leading to the extraction of secrets from the Jenkins agent or server-side request forgery. The impact of this issue is limited to narrow circumstances where attackers can control XML files but are unable to change build steps, Jenkinsfiles, or test code executed on the agents.

Recommendations For Jenkins Violations Plugin versions 0.7.11 and earlier, consider disabling the XML parser functionality until a patch is available to prevent XXE attacks. Restrict access to the 'Report Violations' post-build step to minimize the risk of exploitation. Avoid using external XML files in the affected post-build step until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-45386

GHSA-4598-WCG8-X56G

Affected Products

Jenkins

Jenkins Violations Plugin

References · 7

• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-766 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4598-wcg8-x56g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45386 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45386 · Vendor Advisory
• https://github.com/jenkinsci/violations-plugin · Note
• https://t.me/cvenotify/37788 · Telegram Post
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note