Description

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Remediation

References

https://jenkins.io/security/advisory/2018-01-22/

Related Vulnerabilities

CVE-2013-1921 Vulnerability in maven package org.picketbox:picketbox

CVE-2015-5254 Vulnerability in maven package org.apache.activemq:activemq-client

CVE-2023-33201 Vulnerability in maven package org.bouncycastle:bcprov-ext-jdk15to18

CVE-2022-34187 Vulnerability in maven package aendter.jenkins.plugins:filesystem-list-parameter-plugin

CVE-2018-11804 Vulnerability in maven package org.apache.spark:spark-core_2.11

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory