~ / search / GHSA-wf8m-qr47-xc9m

GHSA-wf8m-qr47-xc9m

Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-28685

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:absint-a3 <= 1.1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control `Project File (APX)` contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

References

External links from the advisory. They lead to third-party sites.