GHSA-g6h2-4x64-c59x

Source

https://github.com/advisories/GHSA-g6h2-4x64-c59x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g6h2-4x64-c59x/GHSA-g6h2-4x64-c59x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g6h2-4x64-c59x

Aliases

CVE-2019-10337

Published

2022-05-24T16:47:43Z

Modified

2024-05-30T14:50:27.747968Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin

Details

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

Database specific

{
    "nvd_published_at": "2019-06-11T14:29:00Z",
    "cwe_ids": [
        "CWE-611"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-28T23:09:04Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:token-macro

Package

Name: org.jenkins-ci.plugins:token-macro; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/token-macro

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.8

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.5.1

1.6

1.7

1.8

1.8.1

1.9

1.10

1.11

1.12

1.12.1

1.13-alpha

2.*

2.0-beta

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

Database specific

{
    "last_known_affected_version_range": "<= 2.7"
}