CVE-2019-10309

Опубликовано: 30 апр. 2019

Источник: nvd

CVSS3: 9.3

CVSS2: 4.8

EPSS Низкий

Описание

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.

Ссылки

http://www.openwall.com/lists/oss-security/2019/04/30/5
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252
Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
http://www.openwall.com/lists/oss-security/2019/04/30/5
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252
Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:self-organizing_swarm_modules:-:*:*:*:*:jenkins:*:*

EPSS

Процентиль: 22%

0.00072

Низкий

9.3 Critical

CVSS3

4.8 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-w898-3ph8-5pgm

CVSS3: 6.1

github

больше 3 лет назад

Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response