PT-2023-21903 · Jenkins · Jenkins Remote-Jobs-View-Plugin+1

Crilwa + 1 · Publicado 2023-03-23 · Atualizado 2025-02-20 · CVE-2023-28684

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier

Description The issue is related to the XML parser not being configured to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Recommendations For Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier, update to a version that configures its XML parser to prevent XML external entity (XXE) attacks. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-28684

GHSA-58CH-C2JF-5G23

Produtos afetados

Jenkins

Jenkins Remote-Jobs-View-Plugin

Referências · 8

• https://github.com/jenkinsci/remote-jobs-view-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28684 · Nota de Segurança
• https://t.me/cvenotify/111950 · Publicação no Telegram
• https://jenkins.io/security/advisory/2023-03-21/#SECURITY-2956 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-58ch-c2jf-5g23 · Aviso do Fabricante
• https://t.me/cvenotify/47368 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28684 · Aviso do Fabricante
• https://t.me/cvenotify/47830 · Publicação no Telegram