PT-2019-11711 · Jenkins · Jenkins Swamp Plugin

Peter Adkins · Publicado 2019-04-30 · Atualizado 2023-10-25 · CVE-2019-10309

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Jenkins Swarm Plugin (affected versions not specified)

Description The issue concerns the Jenkins Swarm Plugin, which allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. The responses to this request are XML documents. However, the Swarm Plugin does not prevent XML External Entity (XXE) processing when processing these responses. This allows unauthorized attackers on the same network to read arbitrary files from Swarm clients or conduct denial-of-service attacks by having Swarm clients parse a maliciously crafted XML response.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-10309

GHSA-W898-3PH8-5PGM

Produtos afetados

Jenkins Swamp Plugin

Referências · 8

• https://web.archive.org/web/20200227073756/http://securityfocus.com/bid/108159 · Nota
• https://osv.dev/vulnerability/GHSA-w898-3ph8-5pgm · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10309 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10309 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/04/30/5 · Nota
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0783 · Nota
• http://securityfocus.com/bid/108159 · Nota