CloudBees Jenkins
En bref
- Source
- NVD
- EPSS
- EPSS 1.41 % · centile 73 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-qj27-w92h-fc9r — XML external entity (XXE) vulnerability in Jenkins
Références européennes
- ENISA EUVD · EUVD-2022-4982
- GCVE · GCVE-0-2015-1809
Configurations affectées (CPE NVD)
cpe:2.3:a:jenkins:cloudbees:*:*:*:*:lts:jenkins:*:*< 1.596.1cpe:2.3:a:jenkins:cloudbees:*:*:*:*:*:jenkins:*:*< 1.600
Produits affectés
| Produit | Versions |
|---|---|
| CloudBees · Jenkins | affected before 1.600 |
| CloudBees · Jenkins LTS | affected before 1.596.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |