PT-2022-27499 · Jenkins · Jenkins Osf Builder Suite : : Xml Linter Plugin+1

Cc Bomber · Published 2022-11-15 · Updated 2025-04-30 · CVE-2022-45397

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins OSF Builder Suite : : XML Linter Plugin versions 1.0.2 and earlier

Description The issue arises from the XML parser not being configured to prevent XML external entity (XXE) attacks. This allows attackers who can control XML files processed by the 'OSF Builder Suite : : XML Linter' build step to craft files that use external entities, potentially leading to the extraction of secrets from the Jenkins agent or server-side request forgery. The impact of this issue is limited to specific circumstances where attackers can control XML files but cannot modify build steps, Jenkinsfiles, or test code executed on the agents.

Recommendations For versions 1.0.2 and earlier, consider configuring the XML parser to prevent XML external entity (XXE) attacks as a mitigation measure. Restrict access to the XML Linter build step to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-45397

GHSA-8847-XVJW-9G43

Affected Products

Jenkins

Jenkins Osf Builder Suite : : Xml Linter Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-45397 · Security Note
• https://osv.dev/vulnerability/GHSA-8847-xvjw-9g43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45397 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-11-15/#SECURITY-2937 · Vendor Advisory
• https://github.com/jenkins-infra/update-center2/pull/658 · Note
• https://github.com/jenkinsci/osf-builder-suite-xml-linter-plugin · Note
• http://openwall.com/lists/oss-security/2022/11/15/4 · Note
• https://t.me/cvenotify/120355 · Telegram Post