XML external entity vulnerability on agents in Jenkins MSTest Plugin
Date: 2023-01
Affected: maven/org.jvnet.hudson.plugins:mstest
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2023-24429
CVE-2023-24430
CVE-2023-24441
CVE-2023-24443
CVE-2023-24450
CWE: CWE-256
CWE-312
CWE-611
CWE-776
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.


Mitigations:

Architectural layers (MAESTRO):