PT-2023-21903 · Jenkins · Jenkins Remote-Jobs-View-Plugin+1

Crilwa + 1 · Published 2023-03-23 · Updated 2025-02-20 · CVE-2023-28684

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier

Description The issue is related to the XML parser not being configured to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Recommendations For Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier, update to a version that configures its XML parser to prevent XML external entity (XXE) attacks. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-28684

GHSA-58CH-C2JF-5G23

Affected Products

Jenkins

Jenkins Remote-Jobs-View-Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-28684 · Security Note
• https://jenkins.io/security/advisory/2023-03-21/#SECURITY-2956 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-58ch-c2jf-5g23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28684 · Vendor Advisory
• https://github.com/jenkinsci/remote-jobs-view-plugin · Note
• https://t.me/cvenotify/111950 · Telegram Post
• https://t.me/cvenotify/47368 · Telegram Post
• https://t.me/cvenotify/47830 · Telegram Post