by Kastro
Paper/Archive/CVE-2023-24443

CVE-2023-24443

Jenkins Project Jenkins TestComplete support Plugin — Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.6.686 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected

ProductAffectedFixed inSource
Jenkins TestComplete support Pluginunspecified – 2.8.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjenkins.io/security/advisory/2023-01-24/#SECURITY-2741