High · 8.8 CVE-2023-41933 EUVD-2023-2507GHSA-ghjw-fcf6-rpr9

Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability

Published Sep 6, 2023 · Updated Sep 26, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Job Configuration History Plugin Package: org.jenkins-ci.plugins:jobConfigHistory Category: Web / CMS Ecosystem: Maven

Description

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

Vendor	Product	Affected	Fixed
Jenkins Project	Jenkins Job Configuration History Plugin	≤ 1227.v7a_79fc4dc01f	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:jobConfigHistory	< 1229.v3039470161a_d	1229.v3039470161a_d	GHSA-ghjw-fcf6-rpr9

Advisories 1

WID-SEC-2023-2286 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 6, 2023

References

Jenkins Security Advisory 2023-09-06 vendor-advisory
http://www.openwall.com/lists/oss-security/2023/09/06/9