CVE-2023-24443

Description

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

How to fix CVE-2023-24443

To remediate CVE-2023-24443, upgrade the affected package to a fixed version below.

• Maven/org.jenkins-ci.plugins:TestComplete—upgrade to 2.9 or later

Is CVE-2023-24443 being exploited?

Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2.9

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-24443
• WEBgithub.com/jenkinsci/testcomplete-plugin/commit/971003ea578a090ed9a5b9487acb9d2aa93645d3
• WEBgithub.com/jenkinsci/testcomplete-plugin/commit/cfb0fc3cd807cb72c24424cef98ce39710f2e5fb
• WEBwww.jenkins.io/security/advisory/2023-01-24/#SECURITY-2741