XML External Entity Vulnerability in Jenkins Maven Release Plugin by Jenkins
CVE-2019-16549

8.1HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Maven Release Plugin
Vendor
CVE Published:
17 December 2019

Summary

The Jenkins Maven Release Plugin, up to version 0.16.1, is susceptible to XML External Entity (XXE) attacks due to improper configuration of its XML parser. This vulnerability allows an attacker to exploit the XML parser by submitting specially crafted XML documents. If successfully executed, this could lead to sensitive data disclosure or manipulation, as the attacker may intercept the XML processing by Jenkins, thereby impacting the integrity and confidentiality of the system.

Affected Version(s)

Jenkins Maven Release Plugin <= 0.16.1

References

https://jenkins.io/security/advisory/2019-12-17/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.