enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability

2022-03-3000:00:23

Google

osv.dev

jenkins

coverage

complexity

scatter plot

plugin

xml

external entity

xxe

vulnerability

attack

input files

post-build step

crafted file

secrets

controller

server-side request forgery

publication

advisory

fix

software

EPSS

0.001

Percentile

28.4%

JSON

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the ‘Public Coverage / Complexity Scatter Plot’ post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.