CVE-2023-24430: XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.27359%
CWE
Published
1/26/2023
Updated
10/27/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:semantic-versioning-plugin | maven | < 1.15 | 1.15 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insecure XML parsing in the PomParser class. The commit diff shows the fix added security attributes (XMLConstants.ACCESS_EXTERNAL_DTD/SCHEMA) to the DocumentBuilderFactory, which were absent in vulnerable versions. The invoke() method directly handles XML parsing, making it the entry point for XXE exploitation. The CVE description explicitly ties the issue to improper XML parser configuration, aligning with this code change.