Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-24429 Details

Description

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%281%29 CVEVendor Advisory
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%281%29 [email protected]Vendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-611Improper Restriction of XML External Entity Reference[email protected]
CWE-611Improper Restriction of XML External Entity ReferenceCISA-ADP

Affected Products

ProductVersions
jenkins semantic versioning
< 1.15

CPE

  • cpe:2.3:a:jenkins:semantic_versioning:*:*:*:*:*:jenkins:*:*

Remediation

  • No remediation found in references.

Change History

8 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-24429
NVD Published Date:
Jan 26, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-24429 Details - Not Deferred