GHSA-58ch-c2jf-5g23

ghsaUSosv

Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

view advisory published 2023-04-02Licence: CC-BY-4.0

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-28684US	medium6.5	0.71% (54th)	—	2023-04-02
Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/remote-jobs-view-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-28684ADVISORY
https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2956WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan