~ / search / GHSA-5xh7-6v3x-vrhj

GHSA-5xh7-6v3x-vrhj

XXE vulnerability in Rundeck Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2144

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:rundeck < 3.6.7 3.6.7

Details

As written in the advisory (Markdown source, shown as plain text).

Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Rundeck Plugin 3.6.7 disables external entity resolution for its XML parser.

References

External links from the advisory. They lead to third-party sites.