CVE-2019-16549

Опубликовано: 17 дек. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.

Ссылки

http://www.openwall.com/lists/oss-security/2019/12/17/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/12/17/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:maven:*:*:*:*:*:jenkins:*:*

Версия до 0.16.1 (включая)

EPSS

Процентиль: 25%

0.00085

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-7mf5-79gv-66gh

CVSS3: 7.1

github

больше 3 лет назад

Jenkins Maven Release Plug-in Plugin XXE vulnerability