GHSA-2q27-6p2h-q6r3

Source

https://github.com/advisories/GHSA-2q27-6p2h-q6r3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2q27-6p2h-q6r3/GHSA-2q27-6p2h-q6r3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2q27-6p2h-q6r3

Aliases

CVE-2026-57303

Published

2026-06-24T15:31:48Z

Modified

2026-09-25T20:00:39Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Jenkins Assembla Plugin has an XXE vulnerability

Details

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when parsing responses from the configured Assembla server.

This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

As of publication of this advisory, there is no fix.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-25T19:47:08Z",
    "nvd_published_at":  "2026-06-24T14:17:36Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:assembla

Package

Name: org.jenkins-ci.plugins:assembla; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/assembla

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.4

Affected versions

1.*

1.2

1.3

1.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-2q27-6p2h-q6r3/GHSA-2q27-6p2h-q6r3.json"