Skip to content
OpenAdvisories
Medium · 5.5 CVE-2022-45386 EUVD-2022-7223GHSA-4598-wcg8-x56g

XML External Entity Reference in Jenkins Violations Plugin

Published Nov 15, 2022 · Updated Apr 30, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Violations Plugin Package: org.jenkins-ci.plugins:violations Category: Web / CMS Ecosystem: Maven

Description

Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Violations Plugin unspecified – ≤ 0.7.11 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:violations <= 0.7.11 — GHSA-4598-wcg8-x56g

Advisories 1

References