XML External Entity Vulnerability in Jenkins RQM Plugin

CVE-2022-41241

What is CVE-2022-41241?

The RQM Plugin for Jenkins versions up to 2.8 is susceptible to XML External Entity (XXE) attacks due to improper configuration of its XML parser. This vulnerability may lead to unauthorized access to sensitive files or enable malicious entities to perform data manipulation and disclose confidential information. The lack of safeguards against external entities in XML documents poses a significant threat to the security integrity of Jenkins environments utilizing this plugin.

References