Protection mechanism failure in Jenkins xUnit Plugin
Priority MEDIUM 42CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-693.
Summary
Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.
Why it matters now
EPSS 0.01344 71st percentileScored 2026-11-07
Fix Fixed org.jenkins-ci.plugins:xunit (Maven): 3.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins xUnit Plugin | up to 3.0.8 | — | No fix listed | CNA |
| — | org.jenkins-ci.plugins:xunit (Maven) | before 3.1.0 | 3.1.0 | Patch available | GHSA-298j-9q4w-6rm4 |
- Jenkins xUnit Plugin VendorJenkins Affected up to 3.0.8 Fixed in — No fix listed CNA
- org.jenkins-ci.plugins:xunit (Maven) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-298j-9q4w-6rm4
Remediation
- Fix · GHSA-298j-9q4w-6rm4 org.jenkins-ci.plugins:xunit (Maven) Fixed in 3.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-34181
- 2026-10-03 Alias added: GHSA-298j-9q4w-6rm4
References
Sources
- CVE-2022-34181 · CVE Program
- CVE-2022-34181 · NVD
- FIRST EPSS
- GHSA-298j-9q4w-6rm4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences