jenkinsci/pipeline-maven-plugin · Security
XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
- GHSA ID
- GHSA-6755-jgp4-8q7h
- CVE ID
- CVE-2019-10327
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CVSS v3
- 8.1 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Description
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10327 ↗
- https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1409 ↗
- http://www.openwall.com/lists/oss-security/2019/05/31/2 ↗
- http://www.securityfocus.com/bid/108540 ↗
- https://github.com/jenkinsci/pipeline-maven-plugin/commit/e7cb858852c05d2423e3fd9922a090982dcd6392 ↗
- https://github.com/advisories/GHSA-6755-jgp4-8q7h ↗