GHSA-p498-rpcw-3578

ghsaUSosv

XXE vulnerability Jenkins Warnings Plugin

view advisory published 2022-05-14Licence: CC-BY-4.0

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000012US	high8.8	0.95% (61st)	—	2018-01-23
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to ext…

references

External citations — patches, advisories, analysis.

https://jenkins.io/security/advisory/2018-01-22WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000012ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan