GitHub Advisoryadvisory · Maven

GHSA-qj27-w92h-fc9r XML external entity (XXE) vulnerability in Jenkins

HIGH Published 2022-05-24 Modified 2024-01-30 Official page ↗
Aliases
CVE-2015-1809
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.597, < 1.600 → fixed in 1.600 • Maven org.jenkins-ci.main:jenkins-core: < 1.596.1 → fixed in 1.596.1

Description

XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.

Related

Alias · CVE (1)

  • CVE-2015-1809 XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References