Description

An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/10/23/2

https://jenkins.io/security/advisory/2019-10-23/#SECURITY-822

Related Vulnerabilities

CVE-2022-25231 Vulnerability in npm package node-opcua

CVE-2022-23307 Vulnerability in maven package org.apache.logging.log4j:log4j

CVE-2020-36188 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2019-19771 Vulnerability in npm package bconi

CVE-2019-20149 Vulnerability in npm package kind-of

Severity

Critical

Classification

CWE-611 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory