Critical · 9.8 CVE-2022-41241 EUVD-2022-6850GHSA-j8xr-2279-88qj

Jenkins RQM Plugin vulnerable to Improper Restriction of XML External Entity Reference

Published Sep 21, 2022 · Updated May 28, 2025 · Assigned by jenkins

Description

Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins RQM Plugin	unspecified – ≤ 2.8	—

Ecosystem	Package	Affected	Fixed	Record
Maven	net.praqma:rqm-plugin	<= 2.8	—	GHSA-j8xr-2279-88qj