Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-41226

CVE-2022-41226: Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference

7.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-41226
GHSA ID
GHSA-g43x-pcc9-f472
EPSS Score
0.42382%
CWE
CWE-611
Published
9/22/2022
Updated
1/5/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.compuware.jenkins:compuware-common-configurationmaven<= 1.0.141.0.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parsing in CLIVersionUtils.parseXml. The commit diff shows security features were added to DocumentBuilderFactory in this function to mitigate XXE. The unpatched version lacked these protections, making XML parsing vulnerable to external entity injection. The function's role in parsing XML files from the Topaz Workbench CLI directory directly matches the attack vector described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *ompuw*r* *ommon *on*i*ur*tion Plu*in *.*.** *n* **rli*r *o*s not *on*i*ur* its XML p*rs*r to pr*v*nt XML *xt*rn*l *ntity (XX*) *tt**ks. T*is *llows *tt**k*rs **l* to ***n** t** *ont*nts o* t** Top*z Work**n** *LI *om* *ir**tory on ***nts to

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rsin* in `*LIV*rsionUtils.p*rs*Xml`. T** *ommit *i** s*ows s**urity ***tur*s w*r* ***** to `*o*um*nt*uil**r***tory` in t*is `*un*tion` to miti**t* XX*. T** unp*t**** v*rsion l**k** t**s* prot**tions, m*kin*