GHSA-38w8-h222-wrpp

Suggest an improvement
Source
https://github.com/advisories/GHSA-38w8-h222-wrpp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-38w8-h222-wrpp/GHSA-38w8-h222-wrpp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-38w8-h222-wrpp
Aliases
Published
2022-02-16T00:01:14Z
Modified
2023-11-08T04:08:44.197216Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Details

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

References

Affected packages

Maven / org.jenkins-ci.plugins:sinatra-chef-builder

Package

Name
org.jenkins-ci.plugins:sinatra-chef-builder
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/sinatra-chef-builder

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
1.20

Affected versions

1.*

1.3
1.14
1.15
1.20