CVE-2022-43415
Published: 19 October 2022
Summary
CVE-2022-43415 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Jenkins Repo. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Jenkins REPO Plugin 1.15.0 and earlier is affected by an XML external entity (XXE) vulnerability because the plugin does not configure its XML parser to prevent such attacks, corresponding to CWE-611. The issue received a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, no required privileges or user interaction, and high confidentiality impact with no integrity or availability effects.
An unauthenticated attacker with network access can supply a crafted XML document to the plugin and read arbitrary files or other sensitive data from the Jenkins instance. The exploitation probability (EPSS) remains flat at 0.0578 with no material increase after disclosure.
Advisories published on 2022-10-19 at the Jenkins security site and oss-security mailing list describe the flaw and direct users to updated plugin releases for remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6995
Vulnerability details
Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.