Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Jenkins Recipe Plugin: Unsecured XML Parsing Allows Data Theft

CVE-2022-34793 · published 4 years ago
Summary

Older versions of the Jenkins Recipe Plugin can be exploited by attackers to steal sensitive data. This is a concern because sensitive information, like credentials, could be accessed. Update to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:recipe <= 1.2
– jenkins recipe <= 1.2
cpe:2.3:a:jenkins:recipe:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published30 Jun 2022
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rm23-6mwv-8q9q · GHSA
CVE-2022-34793 · NVD
Track software like this
Free during beta