Description

Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Remediation

References

https://jenkins.io/security/advisory/2018-02-05/

Related Vulnerabilities

CVE-2015-2582 Vulnerability in maven package org.keycloak:keycloak-saml-core

CVE-2018-1999030 Vulnerability in maven package org.jenkins-ci.plugins:maven-artifact-choicelistprovider

CVE-2019-10319 Vulnerability in maven package org.jenkins-ci.plugins:pam-auth

CVE-2021-34538 Vulnerability in maven package org.apache.hive:hive

CVE-2018-1229 Vulnerability in maven package org.springframework.batch:spring-batch-admin

Severity

Critical

Classification

CWE-611 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Tags

Vendor Advisory