XXE vulnerability in Jenkins Cobertura Plugin

2022-05-2417:10:28

Google

osv.dev

0.001 Low

EPSS

Percentile

28.5%

JSON

Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the ‘Publish Cobertura Coverage Report’ post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Cobertura Plugin 1.16 disables external entity resolution for its XML parser.

CPENameOperatorVersion
org.jenkins-ci.plugins:coberturaeq1.11
org.jenkins-ci.plugins:coberturaeq1.9.5
org.jenkins-ci.plugins:coberturaeq1.9.7
org.jenkins-ci.plugins:coberturaeq1.5
org.jenkins-ci.plugins:coberturaeq1.9.8
org.jenkins-ci.plugins:coberturaeq1.13
org.jenkins-ci.plugins:coberturaeq1.15
org.jenkins-ci.plugins:coberturaeq1.9.1
org.jenkins-ci.plugins:coberturaeq1.3
org.jenkins-ci.plugins:coberturaeq1.7.1

Name	Operator	Version
org.jenkins-ci.plugins:cobertura	eq	1.11
org.jenkins-ci.plugins:cobertura	eq	1.9.5
org.jenkins-ci.plugins:cobertura	eq	1.9.7
org.jenkins-ci.plugins:cobertura	eq	1.5
org.jenkins-ci.plugins:cobertura	eq	1.9.8
org.jenkins-ci.plugins:cobertura	eq	1.13
org.jenkins-ci.plugins:cobertura	eq	1.15
org.jenkins-ci.plugins:cobertura	eq	1.9.1
org.jenkins-ci.plugins:cobertura	eq	1.3
org.jenkins-ci.plugins:cobertura	eq	1.7.1