GHSA-f5wx-w2f9-82gh
XXE vulnerability in Jenkins WebSphere Deployer Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:websphere-deployer | <= 1.6.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a `WEB-INF/ibm-web-ext.xml` which is parsed by the plugin.
References
External links from the advisory. They lead to third-party sites.