PT-2026-51813 · Jenkins · Jenkins Assembla Auth Plugin

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-57303

NVD

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-57303

Produtos afetados

Jenkins Assembla Auth Plugin

Referências · 2

• https://jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1) · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-57303 · Nota de Segurança