CVE-2022-27201: Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Summary
CVE-2022-27201: Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin. Affects org.jenkins-ci.plugins:semantic-versioning-plugin versions < 1.14. Fixed in 1.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Semantic Versioning Plugin is a tool used in Jenkins, an open-source automation server, to process XML files and extract version information. It allows users to define a controller/agent message that handles XML files. However, the plugin does not have proper security measures in place to prevent XML external entity (XXE) attacks. This vulnerability can be exploited if XML documents are parsed on the Jenkins controller. The affected versions of the plugin are 1.13 and earlier. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Vulnerability Detail
The Jenkins Semantic Versioning Plugin does not restrict the execution of a controller/agent message to agents and does not implement limitations on the file path that can be parsed. This allows attackers who can control agent processes to manipulate Jenkins into parsing a crafted file that uses external entities to extract secrets from the Jenkins controller or perform server-side request forgery. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 1.15 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading the Jenkins Semantic Versioning Plugin and Jenkins LTS.
Conclusion
The Jenkins Semantic Versioning Plugin is vulnerable to an agent-to-controller security bypass, allowing attackers to extract secrets or perform server-side request forgery. It is crucial to upgrade the plugin and Jenkins LTS to the recommended versions to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:semantic-versioning-plugin →
FAQ
This vulnerability allows attackers to extract secrets from the Jenkins controller or perform server-side request forgery. It can lead to unauthorized access to sensitive information and potential compromise of the Jenkins server.
This vulnerability is exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fixes by upgrading the Jenkins Semantic Versioning Plugin and Jenkins LTS.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
You can refer to the LTS upgrade guide provided by Jenkins (https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3) for detailed instructions on upgrading to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:semantic-versioning-plugin.
