XML External Entity Processing Vulnerability in Jenkins JUnit Plugin
CVE-2018-1000056

8.3HIGH

Key Information:

Vendor
Jenkins
Status
Junit
Vendor
CVE Published:
9 February 2018

Summary

The Jenkins JUnit Plugin, specifically versions 1.23 and earlier, is susceptible to XML external entity (XXE) processing issues when parsing XML files during the build process. This vulnerability permits attackers with user permissions to exploit the system, leading to potential secrets extraction from the Jenkins master. Additionally, it may allow for server-side request forgery attacks and introduce denial-of-service conditions, jeopardizing the integrity and availability of the Jenkins environment.

References

https://jenkins.io/security/advisory/2018-02-05/
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.