Описание
XXE vulnerability in Jenkins RapidDeploy Plugin
RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.
RapidDeploy Plugin 4.2.1 disables external entity resolution for its XML parser.
Пакеты
org.jenkins-ci.plugins:rapiddeploy-jenkins
< 4.2.1
4.2.1
Связанные уязвимости
Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Уязвимость подключаемого модуля сервера автоматизации Jenkins RapidDeploy Plugin, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю осуществить XXE-атаку