Jenkins Rqm vulnerabilities

3 CVEs affecting Jenkins Rqm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-41241, published 2022-09-21.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-41241, published 2022-09-21. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
• CVE-2022-34810, published 2022-06-30. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A missing check in Jenkins RQM Plugin 2.8 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
• CVE-2022-34809, published 2022-06-30. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file…