jenkinsci/websphere-deployer-plugin · Security
XXE vulnerability in Jenkins WebSphere Deployer Plugin
- GHSA ID
- GHSA-f5wx-w2f9-82gh
- CVE ID
- CVE-2020-2108
- Severity
- high
- Published
- Updated
- CVSS
- 7.6 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- CVSS v3
- 7.6 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Description
WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a WEB-INF/ibm-web-ext.xml which is parsed by the plugin.
CWEs
- CWE-611 · Improper Restriction of XML External Entity Reference