CVE Vulnerability

CVE-2019-10337

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399 Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/06/11/1 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/108747
https://access.redhat.com/errata/RHSA-2019:1636
https://access.redhat.com/errata/RHSA-2019:1851
Configurations

Configuration 1

cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*
Information

Published : 2019-06-11 02:29

Updated : 2019-06-13 01:29

NVD link : CVE-2019-10337

Mitre link : CVE-2019-10337

Products Affected
No products.
CWE
CWE-611

Improper Restriction of XML External Entity Reference