CVE-2022-28140: XXE vulnerability in Jenkins Flaky Test Handler Plugin
Summary
CVE-2022-28140: XXE vulnerability in Jenkins Flaky Test Handler Plugin. Affects org.jenkins-ci.plugins:flaky-test-handler versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Flaky Test Handler Plugin is a Maven package that provides functionality for handling flaky tests in Jenkins. It helps identify and manage tests that produce inconsistent results. The plugin is widely used in Jenkins environments to improve test reliability and stability. However, versions 1.2.1 and earlier of the plugin are vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The XXE vulnerability in Jenkins Flaky Test Handler Plugin allows attackers to exploit the XML parsing functionality of the plugin. By injecting malicious XML entities, an attacker can read arbitrary files on the server or perform other actions that may lead to unauthorized access or data leakage. This vulnerability poses a high risk to the security and integrity of Jenkins environments.
How To Fix
Latest published version: 1.3.172.v35b_30de7fa_5b_ as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk of exploitation.
Conclusion
The XXE vulnerability in Jenkins Flaky Test Handler Plugin poses a significant risk to the security and integrity of Jenkins environments. It is crucial to update the plugin to version 1.2.2 or later to mitigate the risk of exploitation. There are no known workarounds for this vulnerability, and updating the plugin is the only recommended solution. For further support or assistance, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:flaky-test-handler →
FAQ
This vulnerability allows attackers to read arbitrary files on the server or perform other unauthorized actions, potentially leading to data leakage or unauthorized access to sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are detected.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to update the plugin to the latest version to prevent potential exploitation.
No, there is no known workaround for this vulnerability. Updating the plugin to the latest version is the recommended solution to mitigate the risk.
For further support or assistance regarding vulnerability remediation, you can contact info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:flaky-test-handler.
