CVE-2022-30971

CVE-2022-30971: vulnerability in Jenkins Storable Configs Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Storable Configs Plugin+ Monitor org.jvnet.hudson.plugins:storable-configs-plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.3%
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products
Jenkins project · Jenkins Storable Configs Plugin
Related CVEs — Jenkins Storable Configs Plugin

In the same product, most dangerous first.

CVE-2020-2277—CVE-2020-2277EPSS 1.7%CVE-2020-2278—CVE-2020-2278EPSS 1.4%CVE-2022-30972—CVE-2022-30972EPSS 0.7%