PT-2019-11860 · Jenkins · Jenkins 360 Fireline Plugin+1

Thomas De Grenier De Latour · Publicado 2019-10-23 · Atualizado 2023-10-25 · CVE-2019-10466

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Jenkins 360 FireLine Plugin (affected versions not specified)

Description The issue is related to an XML external entities (XXE) vulnerability, which allows attackers with Overall/Read access to have Jenkins resolve external entities. This can result in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2019-10466

GHSA-346G-JRX9-JGF4

Produtos afetados

Jenkins

Jenkins 360 Fireline Plugin

Referências · 6

• https://github.com/jenkinsci/fireline-plugin · Nota
• https://osv.dev/vulnerability/CVE-2019-10466 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-346g-jrx9-jgf4 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-10-23/#SECURITY-822 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10466 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/10/23/2 · Nota