~ / search / GHSA-346g-jrx9-jgf4

GHSA-346g-jrx9-jgf4

Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference

Source: GitHub Advisory Database (reviewed) High CVE-2019-10466

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins.plugin:fireline <= 1.7.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. ## Note: Jenkins has suspended distribution of this plugin.

References

External links from the advisory. They lead to third-party sites.