CVEvulnerability

CVE-2018-1000054

8.3 HIGH Published 2018-02-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-02-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.3 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-611, CWE-918

Description

Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Affected configurations

• jenkins ccm (<= 3.1)

Related

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-918 Server-Side Request Forgery weakness

References