by Kastro
Paper/Archive/CVE-2023-24430

CVE-2023-24430

Jenkins Project Jenkins Semantic Versioning Plugin — Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.0.700 × 2014.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected

ProductAffectedFixed inSource
Jenkins Semantic Versioning Pluginunspecified – 1.14–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%282%29