GHSA-rwg2-w82x-v57j

Source

https://github.com/advisories/GHSA-rwg2-w82x-v57j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-rwg2-w82x-v57j/GHSA-rwg2-w82x-v57j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rwg2-w82x-v57j

Aliases

CVE-2022-28155

Published

2022-03-30T00:00:26Z

Modified

2023-11-08T04:09:02.720245Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin

Details

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control the input files for the readXml or writeXml build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Database specific

{
    "nvd_published_at": "2022-03-29T13:15:00Z",
    "github_reviewed_at": "2022-11-30T20:49:11Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-611"
    ]
}

References

Affected packages

Maven / com.surenpi.jenkins:phoenix-autotest

Package

Name: com.surenpi.jenkins:phoenix-autotest; View open source insights on deps.dev
Purl: pkg:maven/com.surenpi.jenkins/phoenix-autotest

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.3

Affected versions

1.*

1.0

1.1

1.2

1.3