CVE-2022-28154: XML External Entity Reference in Jenkins Coverage/Complexity Scatter Plot Plugin
Summary
CVE-2022-28154: enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability. Affects org.jenkins-ci.plugins:covcomplplot versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Coverage/Complexity Scatter Plot Plugin is a Maven package (org.jenkins-ci.plugins:covcomplplot) used in Jenkins, an open-source automation server. This plugin provides a scatter plot visualization of code coverage and complexity metrics. It allows users to analyze the relationship between code coverage and complexity in their projects. However, versions 1.1.1 and earlier of the plugin are vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The vulnerability in the Jenkins Coverage/Complexity Scatter Plot Plugin arises from its failure to configure the XML parser to prevent XXE attacks. An attacker can exploit this vulnerability by providing a specially crafted XML input that includes external entity references. When the plugin processes this input, it may disclose sensitive information or perform unintended actions on the system. The impact of this vulnerability can be severe, leading to unauthorized data access, denial of service, or remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the plugin to the latest version.
Conclusion
The Jenkins Coverage/Complexity Scatter Plot Plugin (org.jenkins-ci.plugins:covcomplplot) version 1.1.1 and earlier is vulnerable to XML external entity (XXE) attacks. This vulnerability can have severe consequences, including unauthorized data access, denial of service, or remote code execution. It is crucial to update the plugin to version 1.1.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:covcomplplot →
FAQ
The vulnerability can lead to unauthorized data access, denial of service, or remote code execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will alert you in real-time if any open-source vulnerabilities, including this one, are detected.
Yes, an updated version of the Jenkins Coverage/Complexity Scatter Plot Plugin (1.1.2 or later) includes a fix for this vulnerability. It is recommended to update the plugin to the latest version.
No, there are no known workarounds for this vulnerability. Updating the plugin to the latest version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-8rx6-v5q4-xw3j/GHSA-8rx6-v5q4-xw3j.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:covcomplplot.
