CVE-2022-45396
CRITICALCVSS 9.8/10EPSS 0.96%
Last modified
CVE-2022-45396 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.. EPSS estimates a 0.96% chance of exploitation in the next 30 days.
Description
Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Sourcemonitor | <= 0.2 |
References
- https://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
- https://www.openwall.com/lists/oss-security/2022/11/15/4Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-45396?
Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
How severe is CVE-2022-45396?
CVE-2022-45396 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.96% probability of exploitation in the next 30 days.
How do I fix CVE-2022-45396?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-45390A missing permission check in Jenkins loader.io Plugin 1.0.1…4.3
- CVE-2022-45391Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0…7.5
- CVE-2022-45392Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0…6.5
- CVE-2022-45393A cross-site request forgery (CSRF) vulnerability in Jenkins…3.5
- CVE-2022-45394A missing permission check in Jenkins Delete log Plugin 1.0 …4.3
- CVE-2022-45395Jenkins CCCC Plugin 0.6 and earlier does not configure its X…9.8
- CVE-2022-45397Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and ea…9.8
- CVE-2022-45398A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
- CVE-2022-45399A missing permission check in Jenkins Cluster Statistics Plu…4.3
- CVE-2022-4540Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2022-45400Jenkins JAPEX Plugin 1.7 and earlier does not configure its …9.8
- CVE-2022-45401Jenkins Associated Files Plugin 0.2.1 and earlier does not e…5.4
Are you affected by CVE-2022-45396?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST