CVE-2018-1000012

published 2018-01-23

CVE-2018-1000012: Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user…

Priority P3 44 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
jenkins	ant_plugin	—	—
jenkins	nodes_and_processes_plugin	—	—
jenkins	release_plugin	—	—
jenkins	translation_assistance_plugin	—	—
jenkins	warnings	<= 4.64	—

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611