XXE vulnerability in Jenkins OWASP Dependency-Check Plugin
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 26, 2023
Package
Affected versions
<= 5.1.1
Patched versions
5.1.2
Description
Published by the National Vulnerability Database
Nov 12, 2021
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Dec 15, 2022
Last updated
Dec 26, 2023
Credits
-
NotMyFault Analyst
Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
References