GHSA-rwg2-w82x-v57j
XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.surenpi.jenkins:phoenix-autotest | <= 1.3 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control the input files for the `readXml` or `writeXml` build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
References
External links from the advisory. They lead to third-party sites.