CVE-2022-28155
Published: 29 March 2022
Summary
CVE-2022-28155 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Jenkins Pipeline\. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
Jenkins Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier contain an XML external entity vulnerability because the plugin does not configure its XML parser to disable external entity resolution. The affected component is the Jenkins plugin that processes XML input during pipeline execution, and the issue is tracked as CWE-611 with a CVSS 3.1 score of 8.1.
An attacker with low-privileged Jenkins credentials can supply a crafted XML document over the network to the plugin. Successful exploitation allows reading of arbitrary files on the Jenkins controller or other XXE-driven impacts that affect confidentiality and integrity, while availability remains unaffected.
The Jenkins security advisory published on 29 March 2022 recommends upgrading the Pipeline: Phoenix AutoTest Plugin to a version that properly configures the XML parser. The associated EPSS score rose from a low baseline to a peak of 0.0917 on 13 January 2026 before receding, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1538
Vulnerability details
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.