GHSA-vhwv-8897-jm7q

Source

https://github.com/advisories/GHSA-vhwv-8897-jm7q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-vhwv-8897-jm7q/GHSA-vhwv-8897-jm7q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vhwv-8897-jm7q

Aliases

CVE-2022-43430

Published

2022-10-19T19:00:18Z

Modified

2024-02-16T08:23:42.093776Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin

Details

Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the 'Topaz for Total Test - Execute Total Test scenarios' build step to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Database specific

{
    "nvd_published_at": "2022-10-19T16:15:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-19T21:22:06Z"
}

References

Affected packages

Maven / com.compuware.jenkins:compuware-topaz-for-total-test

Package

Name: com.compuware.jenkins:compuware-topaz-for-total-test; View open source insights on deps.dev
Purl: pkg:maven/com.compuware.jenkins/compuware-topaz-for-total-test

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.9

Affected versions

1.*

1.8

1.8.1

1.8.2

2.*

2.0

2.0.1

2.0.2

2.1.0

2.1.1

2.1.2

2.1.3

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.7

2.4.8

Database specific

{
    "last_known_affected_version_range": "<= 2.4.8"
}