CVE-2018-1000056
published 2018-02-09CVE-2018-1000056: Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions…
PriorityP342high8.3CVSS 3.0
AVNACLPRLUINSUCHILAH
EPSS
1.08%
64.8th percentile
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | credentials_binding_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | junit | <= 1.23 | — |
| jenkins | junit_plugin | — | — |
| jenkins | supporting_apis_plugin | — | — |
CVSS provenance
nvdv3.08.3HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
osv·2022-05-14
CVE-2018-1000056 [HIGH] Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
GHSA
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
ghsa·2022-05-14
CVE-2018-1000056 [HIGH] CWE-611 Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Red Hat
jenkins-plugin-junit: XML External Entity (XXE) via a maliciously crafted file
vendor_redhat·2018-02-05·CVSS 8.3
CVE-2018-1000056 [HIGH] CWE-611 jenkins-plugin-junit: XML External Entity (XXE) via a maliciously crafted file
jenkins-plugin-junit: XML External Entity (XXE) via a maliciously crafted file
Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Package: jenkins-plugin-junit (Red Hat OpenShift Enterprise 3) - Will not fix
Jenkins
Jenkins Security Advisory 2018-02-05
vendor_jenkins·2018-02-05·CVSS 8.3
CVE-2018-1000054 [HIGH] Jenkins Security Advisory 2018-02-05
Title: Jenkins Security Advisory 2018-02-05
Jenkins Security Advisory 2018-02-05
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
android-lint
Plugin
ccm
Plugin
Credentials Binding
Plugin
JUnit
Plugin
Pipeline: Supporting APIs
Plugin
Description
XXE vulnerabilities in multiple static analysis plugins
SE
No detection rules found.
No public exploits indexed.
2018-02-09
Published