Vulnerabilities > CVE-2018-1000012 - XXE vulnerability in Jenkins Warnings

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

jenkins

CWE-611

NVD

Published: 2018-01-23

Updated: 2018-02-07

Summary

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Vulnerable Configurations

Part	Description	Count
Application	Jenkins Jenkins Warnings 1.0 Jenkins Warnings 1.1 Jenkins Warnings 1.2 Jenkins Warnings 1.3 Jenkins Warnings 1.4 Jenkins Warnings 1.5 Jenkins Warnings 1.6 Jenkins Warnings 1.7 Jenkins Warnings 1.8 Jenkins Warnings 1.9 Jenkins Warnings 1.10 Jenkins Warnings 1.11 Jenkins Warnings 1.12 Jenkins Warnings 1.13 Jenkins Warnings 1.14 Jenkins Warnings 1.15 Jenkins Warnings 1.16 Jenkins Warnings 1.17 Jenkins Warnings 1.18 Jenkins Warnings 1.19 Jenkins Warnings 1.20 Jenkins Warnings 1.21 Jenkins Warnings 1.22 Jenkins Warnings 1.23 Jenkins Warnings 1.24 Jenkins Warnings 1.25 Jenkins Warnings 1.26 Jenkins Warnings 1.27 Jenkins Warnings 1.28 Jenkins Warnings 1.29 Jenkins Warnings 2.0 Jenkins Warnings 2.1 Jenkins Warnings 2.2 Jenkins Warnings 2.3 Jenkins Warnings 2.4 Jenkins Warnings 2.5 Jenkins Warnings 2.6 Jenkins Warnings 2.7 Jenkins Warnings 2.8 Jenkins Warnings 2.9 Jenkins Warnings 2.10 Jenkins Warnings 2.11 Jenkins Warnings 2.12 Jenkins Warnings 2.13 Jenkins Warnings 2.14 Jenkins Warnings 3.0 Jenkins Warnings 3.1 Jenkins Warnings 3.2 Jenkins Warnings 3.3 Jenkins Warnings 3.4 Jenkins Warnings 3.5 Jenkins Warnings 3.6 Jenkins Warnings 3.7 Jenkins Warnings 3.8 Jenkins Warnings 3.9 Jenkins Warnings 3.10 Jenkins Warnings 3.11 Jenkins Warnings 3.12 Jenkins Warnings 3.13 Jenkins Warnings 3.14 Jenkins Warnings 3.15 Jenkins Warnings 3.16 Jenkins Warnings 3.17 Jenkins Warnings 3.18 Jenkins Warnings 3.19 Jenkins Warnings 3.20 Jenkins Warnings 3.21 Jenkins Warnings 3.22 Jenkins Warnings 3.23 Jenkins Warnings 3.24 Jenkins Warnings 3.25 Jenkins Warnings 3.26 Jenkins Warnings 3.27 Jenkins Warnings 3.28 Jenkins Warnings 4.0 Jenkins Warnings 4.1 Jenkins Warnings 4.2 Jenkins Warnings 4.3 Jenkins Warnings 4.4 Jenkins Warnings 4.5 Jenkins Warnings 4.6 Jenkins Warnings 4.7 Jenkins Warnings 4.8 Jenkins Warnings 4.9 Jenkins Warnings 4.10 Jenkins Warnings 4.11 Jenkins Warnings 4.12 Jenkins Warnings 4.13 Jenkins Warnings 4.14 Jenkins Warnings 4.15 Jenkins Warnings 4.16 Jenkins Warnings 4.17 Jenkins Warnings 4.18 Jenkins Warnings 4.19 Jenkins Warnings 4.20 Jenkins Warnings 4.21 Jenkins Warnings 4.22 Jenkins Warnings 4.23 Jenkins Warnings 4.24 Jenkins Warnings 4.25 Jenkins Warnings 4.26 Jenkins Warnings 4.27 Jenkins Warnings 4.28 Jenkins Warnings 4.29 Jenkins Warnings 4.30 Jenkins Warnings 4.31 Jenkins Warnings 4.32 Jenkins Warnings 4.33 Jenkins Warnings 4.34 Jenkins Warnings 4.35 Jenkins Warnings 4.36 Jenkins Warnings 4.37 Jenkins Warnings 4.38 Jenkins Warnings 4.39 Jenkins Warnings 4.40 Jenkins Warnings 4.41 Jenkins Warnings 4.42 Jenkins Warnings 4.43 Jenkins Warnings 4.44 Jenkins Warnings 4.45 Jenkins Warnings 4.46 Jenkins Warnings 4.47 Jenkins Warnings 4.48 Jenkins Warnings 4.49 Jenkins Warnings 4.50 Jenkins Warnings 4.51 Jenkins Warnings 4.52 Jenkins Warnings 4.53 Jenkins Warnings 4.54 Jenkins Warnings 4.55 Jenkins Warnings 4.56 Jenkins Warnings 4.57 Jenkins Warnings 4.58 Jenkins Warnings 4.59 Jenkins Warnings 4.60 Jenkins Warnings 4.61 Jenkins Warnings 4.62 Jenkins Warnings 4.63 Jenkins Warnings 4.64	139

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://jenkins.io/security/advisory/2018-01-22/