GitHub Advisoryadvisory · Maven

GHSA-vhwv-8897-jm7q XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin

HIGH Published 2022-10-19 Modified 2022-12-16 Official page ↗
Aliases
CVE-2022-43430
Ecosystem
Maven
Packages
com.compuware.jenkins:compuware-topaz-for-total-test
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-611
Reviewed
2022-10-19

Affected packages

• Maven com.compuware.jenkins:compuware-topaz-for-total-test: < 2.4.9 → fixed in 2.4.9

Description

Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control the input files for the 'Topaz for Total Test - Execute Total Test scenarios' build step to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Related

Alias · CVE (1)

  • CVE-2022-43430 Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE)… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References