CVE-2022-43415: XXE vulnerability in Jenkins REPO Plugin
Summary
CVE-2022-43415: XXE vulnerability in Jenkins REPO Plugin. Affects org.jenkins-ci.plugins:repo versions < 1.16.0. Fixed in 1.16.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins REPO Plugin is a Maven ecosystem package that provides functionality for managing repositories in Jenkins. It allows users to define and configure repositories for their projects. The plugin is widely used in Jenkins environments for managing dependencies and artifacts. However, versions 1.15.0 and earlier of the REPO Plugin are vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The XXE vulnerability in the Jenkins REPO Plugin allows attackers who can control the repo binary executed on agents to exploit a flaw in the XML parser. By crafting a malicious XML document, an attacker can trigger the parsing process and extract sensitive information from the Jenkins controller. This can lead to unauthorized access to secrets or server-side request forgery. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 1.17.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of the REPO Plugin.
Conclusion
The XXE vulnerability in the Jenkins REPO Plugin (CVE-2022-43415) poses a significant risk to Jenkins installations. It allows attackers to extract sensitive information or perform server-side request forgery. To mitigate this vulnerability, it is crucial to upgrade to version 1.16.0 or later of the REPO Plugin. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:repo →
FAQ
The vulnerability allows attackers to extract sensitive information from the Jenkins controller or perform server-side request forgery, potentially leading to unauthorized access or further exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time for open-source vulnerabilities.
There are no known instances of this vulnerability being exploited in the wild. However, it is essential to apply the recommended fix to prevent potential attacks.
No, the recommended fix is to upgrade to the latest version of the REPO Plugin. This ensures that the XXE vulnerability is effectively mitigated.
You can find more information about the vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-2w2m-ccf8-57cq/GHSA-2w2m-ccf8-57cq.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:repo.
