cbcvebase.
CVE-2023-24443
published 2023-01-26

CVE-2023-24443: Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

PriorityP342critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.21%
65.0th percentile
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected

23 ranges
VendorProductVersion rangeFixed in
jenkinsbearychat_plugin——
jenkinsbitbucket_oauth_plugin——
jenkinscisco_spark_notifier_plugin——
jenkinsgerrit_trigger_plugin——
jenkinsgithub_pull_request_builder_plugin——
jenkinsgithub_pull_request_coverage_status_plugin——
jenkinsids_in_orka_by_macstadium_plugin——
jenkinsjira_pipeline_steps_plugin——
jenkinskeycloak_authentication_plugin——
jenkinskubernetes_credentials_provider_plugin——
jenkinsmacstadium_plugin——
jenkinsmstest_plugin——
jenkinsopenid_connect_authentication_plugin——
jenkinsopenid_plugin——
jenkinsorka_by_macstadium_plugin——
jenkinspwauth_security_realm_plugin——
jenkinsrabbitmq_consumer_plugin——
jenkinsscript_security_plugin——
jenkinssemantic_versioning_plugin——
jenkinstestcomplete_support<= 2.8.1—
jenkinstestcomplete_support_plugin——
jenkinstestquality_updater_plugin——
jenkins_projectjenkins_testcomplete_support_pluginunspecified – 2.8.1—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.