PT-2022-27498 · Jenkins · Jenkins Sourcemonitor Plugin+1

Cc Bomber · Published 2022-11-15 · Updated 2025-04-30 · CVE-2022-45396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins SourceMonitor Plugin versions 0.2 and earlier

Description The issue allows attackers to control XML input files for the 'Publish SourceMonitor results' post-build step, enabling them to have agent processes parse a crafted file that uses external entities for extraction of secrets from the Jenkins agent or server-side request forgery. This has a real impact in narrow circumstances where attackers can control XML files but are unable to change build steps, Jenkinsfiles, test code, or similar.

Recommendations For Jenkins SourceMonitor Plugin versions 0.2 and earlier, update the plugin to a version that configures its XML parser to prevent XML external entity (XXE) attacks. As a temporary workaround, consider restricting access to the 'Publish SourceMonitor results' post-build step to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-45396

GHSA-H4WX-78P9-FWXW

Affected Products

Jenkins

Jenkins Sourcemonitor Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-45396 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45396 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2927 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h4wx-78p9-fwxw · Vendor Advisory
• https://github.com/jenkinsci/sourcemonitor-plugin · Note
• https://t.me/cvenotify/120354 · Telegram Post
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note