Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to provide crafted API responses from Rational Quality Manager to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. There is currently no known workaround or fix for this issue.

Affected Packages

Maven net.praqma:rqm-plugin

Affected versions: 0 (last affected: 2.8)

Related CVEs

CVE-2022-41241

Key Information

GHSA ID

GHSA-j8xr-2279-88qj

Published

September 22, 2022 12:00 AM

Last Modified

December 6, 2022 7:41 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

net.praqma:rqm-plugin

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.