GitHub Advisoryadvisory · Maven

GHSA-g6h2-4x64-c59x Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

HIGH Published 2022-05-24 Modified 2024-05-30 Official page ↗
Aliases
CVE-2019-10337
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:token-macro
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.plugins:token-macro: < 2.8 → fixed in 2.8

Description

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

Related

Alias · CVE (1)

  • CVE-2019-10337 An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References