GitHub Advisory DatabaseGHSA-P674-HH8X-RV5HXML external entity vulnerability in Jenkins Nuget Plugin
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
55.1%
Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This XML parser is used for the "Build on NuGet updates" feature.
This allows attackers with the ability to control the contents of the packages.config file in a workspace to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Jenkins Nuget Plugin 1.1 disables external entity resolution for its XML parser.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| org.jenkins-ci.plugins | nuget | * | cpe:2.3:a:org.jenkins-ci.plugins:nuget:*:*:*:*:*:*:*:* |
References
www.openwall.com/lists/oss-security/2021/05/25/3
github.com/advisories/GHSA-p674-hh8x-rv5h
github.com/jenkinsci/nuget-plugin/commit/542bf38ac52f045741a5670e1644af351878f7e0
github.com/jenkinsci/nuget-plugin/commit/c8ed4cb5b1c42f3c407f9f418b4e0b4274bea5a9
nvd.nist.gov/vuln/detail/CVE-2021-21658
www.jenkins.io/security/advisory/2021-05-25/#SECURITY-2340
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
55.1%