Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-24430 EUVD-2023-0484GHSA-h8p8-6378-649p

XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin

Published Jan 24, 2023 · Updated Apr 2, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Semantic Versioning Plugin Package: org.jenkins-ci.plugins:semantic-versioning-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Semantic Versioning Plugin unspecified – ≤ 1.14 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:semantic-versioning-plugin < 1.15 1.15 GHSA-h8p8-6378-649p

Advisories 1

References