PT-2022-27498 · Jenkins · Jenkins Sourcemonitor Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SourceMonitor Plugin versions 0.2 and earlier Description: The issue allows attackers to control XML input files for the 'Publish SourceMonitor results' post-build step, enabling them to have agent processes parse a crafted file that...

XXE vulnerability on agents in sourcemonitor

sourcemonitor 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities for...