CVE-2023-24430: XML External Entity Reference Vulnerability in Jenkins Semantic Versioning Plugin
Summary
CVE-2023-24430: XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin. Affects org.jenkins-ci.plugins:semantic-versioning-plugin versions < 1.15. Fixed in 1.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Semantic Versioning Plugin is a Maven-based plugin that provides functionality for managing semantic versions in Jenkins. It allows users to define version patterns and automatically increment versions based on build results. This plugin is widely used in Jenkins-based CI/CD pipelines to manage versioning of software projects.
Vulnerability Detail
The Jenkins Semantic Versioning Plugin version 1.14 and earlier is vulnerable to an XML external entity (XXE) reference vulnerability. This vulnerability occurs because the plugin does not properly configure its XML parser to prevent XXE attacks. An attacker can exploit this vulnerability by providing a specially crafted XML input, which can lead to the disclosure of sensitive information, denial of service, or remote code execution.
How To Fix
Latest published version: 1.15 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the latest version of the Jenkins Semantic Versioning Plugin.
Conclusion
The Jenkins Semantic Versioning Plugin version 1.14 and earlier is vulnerable to an XML external entity reference vulnerability. To mitigate this vulnerability, it is recommended to upgrade to version 1.15 or later of the plugin. There are no known workarounds for this vulnerability. It is important to patch your systems as soon as possible to prevent potential exploitation. For further support, you can contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:semantic-versioning-plugin →
FAQ
This vulnerability can be exploited by an attacker to disclose sensitive information, cause denial of service, or execute remote code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this one.
There are currently no known public exploits for this vulnerability. However, it is important to patch your systems as soon as possible to mitigate the risk.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:semantic-versioning-plugin.
