by Kastro
Paper/Archive/CVE-2022-41226

CVE-2022-41226

Jenkins project Jenkins Compuware Common Configuration Plugin — Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) a…

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.9.609 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected

ProductAffectedFixed inSource
Jenkins Compuware Common Configuration Pluginunspecified – 1.0.14–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjenkins.io/security/advisory/2022-09-21/#SECURITY-2832