Description

Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Remediation

References

https://jenkins.io/security/advisory/2018-01-22/

Related Vulnerabilities

CVE-2023-34238 Vulnerability in npm package gatsby-plugin-sharp

CVE-2023-37954 Vulnerability in maven package com.sonyericsson.hudson.plugins.rebuild:rebuild

CVE-2019-3778 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2020-11969 Vulnerability in maven package org.apache.tomee:openejb-core

CVE-2023-26470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory