PT-2023-26190 · Jenkins · Jenkins External Monitor Job Type Plugin+1

Atorralba + 1 · Publicado 2023-07-12 · Atualizado 2023-07-20 · CVE-2023-37942

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins External Monitor Job Type Plugin versions 206.v9a 94ff0b 4a 10 and earlier

Description The issue allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

Recommendations For versions 206.v9a 94ff0b 4a 10 and earlier, update to version 207.v98a a 37a 85525 or later, which disables external entity resolution for its XML parser. As a temporary workaround, consider restricting access to the plugin's XML parser to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-37942

GHSA-G4C3-4F3V-84X8

Produtos afetados

Jenkins

Jenkins External Monitor Job Type Plugin

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-37942 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-g4c3-4f3v-84x8 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/12/2 · Nota
• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-3133 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-37942 · Aviso do Fabricante
• https://t.me/cibsecurity/66594 · Publicação no Telegram
• https://t.me/cvenotify/54349 · Publicação no Telegram