Description

Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Remediation

References

https://jenkins.io/security/advisory/2018-01-22/

Related Vulnerabilities

CVE-2022-2053 Vulnerability in maven package io.undertow:undertow-core

CVE-2023-45138 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-ui

CVE-2020-27217 Vulnerability in maven package org.eclipse.hono:hono-bom

CVE-2021-41766 Vulnerability in maven package org.apache.karaf:apache-karaf

CVE-2022-41246 Vulnerability in maven package org.jenkins-ci.plugins:ws-execution-manager

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory