VDB
CVE-2023-24443
CVE-2023-24443
PUBLISHED
CVSS 9.8 CRITICAL
XML Entity Expansion in Jenkins TestComplete support Plugin
Reported by jenkins · Published January 24, 2023
TestComplete is fixed in 2.9 and 2.8.1 (Maven Central)
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins:TestComplete | Maven Central | 2.9, 2.8.1 |
| Jenkins TestComplete support Plugin | Jenkins Project | unspecified, 2.8.1 |
| testcomplete_support | jenkins | 2.8.1 |
Risk scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins TestComplete support Plugin | unspecified, next of 2.8.1 |
| Maven | org.jenkins-ci.plugins:TestComplete | 0 |
| Jenkins Project | Jenkins TestComplete support Plugin | *, 2.8.1 |
Timeline
- Jan 24, 2023 CVE Published
- Jan 25, 2023 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory (13 in total, the first dated here)
- Mar 21, 2026 Distribution Patch (12 in total, the first dated here)
- Jun 17, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-24443
vulnetix vdb fixes CVE-2023-24443Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-24443/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart