PT-2023-26190 · Jenkins · Jenkins External Monitor Job Type Plugin+1

Atorralba + 1 · Published 2023-07-12 · Updated 2023-07-20 · CVE-2023-37942

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins External Monitor Job Type Plugin versions 206.v9a 94ff0b 4a 10 and earlier

Description The issue allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

Recommendations For versions 206.v9a 94ff0b 4a 10 and earlier, update to version 207.v98a a 37a 85525 or later, which disables external entity resolution for its XML parser. As a temporary workaround, consider restricting access to the plugin's XML parser to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-37942

GHSA-G4C3-4F3V-84X8

Affected Products

Jenkins

Jenkins External Monitor Job Type Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-37942 · Security Note
• https://osv.dev/vulnerability/GHSA-g4c3-4f3v-84x8 · Vendor Advisory
• https://jenkins.io/security/advisory/2023-07-12/#SECURITY-3133 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37942 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/07/12/2 · Note
• https://t.me/cibsecurity/66594 · Telegram Post
• https://t.me/cvenotify/54349 · Telegram Post