Home > Vulnerability Database > CVE-2022-41226

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2022-41226

Good to know:

Date: September 21, 2022

Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Language: Java

Severity Score

9.8

Related Resources (8)

Url: https://github.com/jenkinsci/compuware-common-configuration-plugin/commit/8410fd5e0a619200f5bc2e906ecba940e8506436

Url: https://github.com/jenkinsci/compuware-common-configuration-plugin/pull/24

Url: https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2832

Url: https://nvd.nist.gov/vuln/detail/CVE-2022-41226

Url: https://github.com/jenkinsci/compuware-common-configuration-plugin

Url: https://github.com/jenkinsci/compuware-common-configuration-plugin/commit/351a46798cdc10479cb6966f05a51bc2174806a0

Url: https://github.com/jenkinsci/compuware-common-configuration-plugin/commit/a92f1fba5ab375cfcceed92a16666a4c709e0f3b

Url: https://www.mend.io/vulnerability-database/CVE-2022-41226

Severity Score

9.8

Weakness Type (CWE)

Improper Restriction of XML External Entity Reference ('XXE')

CWE-611

Top Fix

Upgrade Version

Upgrade to version com.compuware.jenkins:compuware-common-configuration:1.0.15

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us