Medium · 6.5 CVE-2023-37942 EUVD-2023-2053GHSA-g4c3-4f3v-84x8

Jenkins External Monitor Job Type Plugin XML external entity vulnerability

Published Jul 12, 2023 · Updated Nov 7, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins External Monitor Job Type Plugin Package: org.jenkins-ci.plugins:external-monitor-job Category: Web / CMS Ecosystem: Maven

Description

Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins External Monitor Job Type Plugin	≤ 206.v9a_94ff0b_4a_10	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:external-monitor-job	< 207.v98a	207.v98a	GHSA-g4c3-4f3v-84x8

Advisories 1

WID-SEC-2023-1743 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 11, 2024

References

Jenkins Security Advisory 2023-07-12 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/12/2