Description

Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Remediation

References

https://jenkins.io/security/advisory/2018-01-22/

Related Vulnerabilities

CVE-2023-40343 Vulnerability in maven package io.jenkins.plugins:tuleap-oauth

CVE-2022-36911 Vulnerability in maven package org.jenkins-ci.plugins:openstack-heat

CVE-2022-42128 Vulnerability in maven package com.liferay:com.liferay.headless.delivery.impl

CVE-2018-11787 Vulnerability in maven package org.apache.karaf.webconsole:org.apache.karaf.webconsole.features

CVE-2012-5885 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory CWE-611