CVE-2022-45386

Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

• CWE-611
• CWE-611

• https://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-766Vendor Advisory
• https://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-766Vendor Advisory

Published

Nov 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45380Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier convert…5.4
• CVE-2022-45381Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier doe…8.1
• CVE-2022-45382Jenkins Naginator Plugin 1.18.1 and earlier does not escape …5.4
• CVE-2022-45383An incorrect permission check in Jenkins Support Core Plugin…6.5
• CVE-2022-45384Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores t…6.5
• CVE-2022-45385A missing permission check in Jenkins CloudBees Docker Hub/R…7.5
• CVE-2022-45387Jenkins BART Plugin 1.0.3 and earlier does not escape the pa…5.4
• CVE-2022-45388Jenkins Config Rotator Plugin 2.0.1 and earlier does not res…7.5
• CVE-2022-45389A missing permission check in Jenkins XP-Dev Plugin 1.0 and …5.3
• CVE-2022-4539The Web Application Firewall plugin for WordPress is vulnera…5.3
• CVE-2022-45390A missing permission check in Jenkins loader.io Plugin 1.0.1…4.3
• CVE-2022-45391Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0…7.5