Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-45396 EUVD-2022-7355GHSA-h4wx-78p9-fwxw

XXE vulnerability on agents in Jenkins SourceMonitor Plugin

Published Nov 15, 2022 · Updated Apr 30, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins SourceMonitor Plugin Package: com.thalesgroup.hudson.plugins:sourcemonitor Category: Web / CMS Ecosystem: Maven

Description

Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins SourceMonitor Plugin unspecified – ≤ 0.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.thalesgroup.hudson.plugins:sourcemonitor <= 0.2 — GHSA-h4wx-78p9-fwxw

Advisories 1

References