PT-2019-14704 · Jenkins · Jenkins Maven Release Plugin+1

Published 2019-12-17 · Updated 2023-10-25 · CVE-2019-16549

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Maven Release Plugin versions 0.16.1 and earlier

Description The issue allows man-in-the-middle attackers to have Jenkins parse crafted XML documents due to the XML parser not being configured to prevent XML external entity (XXE) attacks. This could be exploited, especially if the URL is not HTTPS, allowing attackers to extract secrets from the Jenkins controller, perform server-side request forgery, or launch denial-of-service attacks. A cross-site request forgery vulnerability is also present due to a connection test form validation method not requiring POST requests.

Recommendations For Jenkins Maven Release Plugin versions 0.16.1 and earlier, update to version 0.16.2, which configures the XML parser to prevent XML external entity (XXE) attacks and requires POST requests for the connection test form validation method to protect against cross-site request forgery attacks.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2019-16549

GHSA-7MF5-79GV-66GH

Affected Products

Jenkins

Jenkins Maven Release Plugin

References · 6

• https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7mf5-79gv-66gh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16549 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16549 · Vendor Advisory
• https://github.com/jenkinsci/m2release-plugin/commit/1e4d6fee2eab16e7a396b6d3d5f10a87e5c29cc2 · Note
• http://openwall.com/lists/oss-security/2019/12/17/1 · Note