CVE-2022-46682: Jenkins Plot Plugin XML External Entity Reference vulnerability
Summary
CVE-2022-46682: Jenkins Plot Plugin XML External Entity Reference vulnerability. Affects org.jenkins-ci.plugins:plot versions < 2.1.12. Fixed in 2.1.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Plot Plugin is a plugin for the Jenkins automation server that allows users to create plots and charts based on build data. It is commonly used to visualize trends and statistics in software development projects. The plugin is written in Java and follows the Maven ecosystem. It provides functionality for parsing and processing XML files to generate plots. However, versions 2.1.11 and earlier of the plugin do not properly configure their XML parser, making them vulnerable to XML external entity (XXE) attacks.
Vulnerability Detail
The vulnerability in Jenkins Plot Plugin 2.1.11 and earlier arises from the lack of protection against XML external entity (XXE) attacks. Attackers who can control XML input files for the 'Plot build data' build step can exploit this vulnerability to trick Jenkins into parsing a specially crafted file. By leveraging external entities, the attacker can extract sensitive information from the Jenkins controller or perform server-side request forgery. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: 698.v42408994b_b_b_a_ as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins Plot Plugin to the latest version to ensure the security of the system.
Conclusion
The Jenkins Plot Plugin versions 2.1.11 and earlier are vulnerable to an XML external entity (XXE) attack. This vulnerability can be exploited by attackers to extract sensitive information or perform server-side request forgery. To mitigate this vulnerability, it is crucial to update the plugin to version 2.1.12 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:plot →
FAQ
The Jenkins Plot Plugin is a plugin for the Jenkins automation server that allows users to create plots and charts based on build data. It is commonly used to visualize trends and statistics in software development projects.
An XML external entity (XXE) attack is a type of attack that exploits vulnerabilities in XML parsers. By injecting specially crafted XML input, an attacker can trick the parser into accessing external entities, which may lead to information disclosure or other malicious actions.
This vulnerability allows attackers to extract sensitive information from the Jenkins controller or perform server-side request forgery. This can lead to unauthorized access, data leakage, or further compromise of the system.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
To update the Jenkins Plot Plugin, follow the standard update process for Jenkins plugins. Ensure that you are using version 2.1.12 or later to mitigate the XXE vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:plot.
