What is GHSA-wgpp-g6v9-7hxp?

GHSA-wgpp-g6v9-7hxp is a security advisory published by GitHub Security Advisories with High severity. Jenkins Plot Plugin XML External Entity Reference vulnerability

Which CVE IDs does GHSA-wgpp-g6v9-7hxp cover?

GHSA-wgpp-g6v9-7hxp covers the following CVE IDs: CVE-2022-46682. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wgpp-g6v9-7hxp?

GHSA-wgpp-g6v9-7hxp has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-wgpp-g6v9-7hxp?

GHSA-wgpp-g6v9-7hxp affects 1 product, including: maven/org.jenkins-ci.plugins:plot:\u003c 2.1.12.

GHSA-wgpp-g6v9-7hxpHighCVSS 7.1

Jenkins Plot Plugin XML External Entity Reference vulnerability

Vendor

GitHub Security Advisories

Published

December 12, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-46682 →

📋 Description

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Plot Plugin 2.1.12 disables external entity resolution for its XML parser.

🎯 Affected products1

maven/org.jenkins-ci.plugins:plot:< 2.1.12

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-46682
https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2940
https://github.com/jenkinsci/plot-plugin/commit/4f7afbe064aab538a242a9984e583e513863e0ac
https://github.com/advisories/GHSA-wgpp-g6v9-7hxp