CVE-2023-37942
MEDIUM6.5EPSS 0.31%Jenkins External Monitor Job Type Plugin XML external entity vulnerability
發布日:2023/7/12修改日:2024/2/16
描述
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. External Monitor Job Type Plugin 207.v98a_a_37a_85525 disables external entity resolution for its XML parser.
受影響套件(1)
- Maven/org.jenkins-ci.plugins:external-monitor-jobfrom 0, < 207.v98a
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |