CVE-2022-25209 — XML External Entity (XXE) Injection in Project Jenkins Chef Sinatra Plugin

CWE-611 — XML External Entity (XXE) Injection5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 70.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Chef Sinatra PluginJenkins Chef Sinatra
Timeline
PublishedFeb 15
Latest updateFeb 16

Description

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_chef_sinatra_pluginunspecified — 1.20

🔴Vulnerability Details

3
OSV
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra↗2022-02-16
▶
GHSA
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra↗2022-02-16
▶
CVEList
CVE-2022-25209: Jenkins Chef Sinatra Plugin 1↗2022-02-15
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-02-15↗2022-02-15
▶
CVE-2022-25209 — XML External Entity (XXE) Injection | cvebase