Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Jenkins Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.
Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of a controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jenkins-ci.plugins:semantic-versioning-plugin | < 1.14 | 1.14 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N- Weakness (CWE)
CWE-611, CWE-918- Platform
- Java / Kotlin (Maven)
- Package
org.jenkins-ci.plugins:semantic-versioning-plugin- Disclosed
- 16.03.2022
- Updated
- 11.10.2026 11:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-x3m3-g8w6-mf28 - CC BY 4.0
Vulnerability history: org.jenkins-ci.plugins:semantic-versioning-plugin
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2022 01.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
Disclosures per year
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.