CVE-2018-1000056

CWE-611 — XML External Entity (XXE)CWE-918 — Server-Side Request Forgery (SSRF)7 documents7 sources
Severity
8.3HIGH
EPSS
0.1%
top 65.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Junit
Timeline
PublishedFeb 9
Latest updateMay 14

Description

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:HExploitability: 2.8 | Impact: 5.5

Affected Packages2 packages

▶NVDjenkins/junit1.23

🔴Vulnerability Details

3
OSV
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin↗2022-05-14
▶
GHSA
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin↗2022-05-14
▶
CVEList
CVE-2018-1000056: Jenkins JUnit Plugin 1↗2018-02-09
▶

📋Vendor Advisories

2
Red Hat
jenkins-plugin-junit: XML External Entity (XXE) via a maliciously crafted file↗2018-02-05
▶
Jenkins
Jenkins Security Advisory 2018-02-05↗2018-02-05
▶

💬Community

1
Bugzilla
CVE-2018-1000056 jenkins-plugin-junit: XML External Entity (XXE) via a maliciously crafted file↗2018-02-06
▶
CVE-2018-1000056 (HIGH CVSS 8.3) | Jenkins JUnit Plugin 1.23 and earli | cvebase.io