GHSA-4rj6-9pjh-882r

ghsaUSosv

Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin

view advisory published 2022-05-14Licence: CC-BY-4.0

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000056US	high8.3	1.08% (65th)	—	2018-02-09
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extrac…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/junit-pluginPACKAGE
https://github.com/jenkinsci/junit-plugin/commit/15f39fc49d9f25bca872badb48e708a8bb815ea7WEB
https://jenkins.io/security/advisory/2018-02-05WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000056ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan