CVE-2023-24430: Improper Restriction of XML External Entity Reference

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

PT-2023-19589 · Jenkins · Jenkins Semantic Versioning Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Semantic Versioning Plugin versions 1.14 and earlier Description: The issue allows attackers who can control agent processes to have Jenkins parse a crafted file, potentially leading to the extraction of secrets from the Jenkins...

CVE-2023-24429

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses externa...

XXE vulnerability on agents in semantic-versioning-plugin

semantic-versioning-plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the contents of the version file for the 'Determine Semantic Version' build step to have agent processes parse a crafted file that uses...

Agent-to-controller security bypass in semantic-versioning-plugin

semantic-versioning-plugin defines a controller/agent message that processes a given file as XML and its XML parser is not configured to prevent XML external entity XXE attacks. semantic-versioning-plugin 1.14 and earlier does not restrict execution of the controller/agent message to agents, and...

CVE-2023-24429

CVE-2023-24429 affects Jenkins Plugin: Semantic Versioning Plugin (versions ≤ 1.14). Root cause: XML parsing of a crafted controller/agent message that allows XML external entity (XXE) processing, enabling exfiltration of secrets from the Jenkins controller or triggering server-side requests. Imp...

CVE-2023-24430

CVE-2023-24430 affects Jenkins Semantic Versioning Plugin 1.14 and earlier, where the XML parser is not configured to prevent XML external entity (XXE) attacks. This XXE flaw could enable an attacker able to influence agent/controller parsing to exfiltrate data or affect processing. The issue is ...

This Week in Spring - January 9th, 2023

Hi, Spring fans! As I write this Im on a plane winging my way to Helsinki, Finland. A new year and new journeys begin. Its going to be cold there. Wish me luck! Do you know what always warms me up? The thrill of learning. And this weeks no different. This week weve got some good stuff line up so...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=4.0, <=6.3) potentially affected by CVE-2022-31190 via org.dspace:dspace-xmlui (>=4.0, <=6.3)

org.dspace:dspace-xmlui MAVEN version =4.0, =5.4.0, =4.0, =6.3 Source cves: CVE-2022-31190 Source advisory: GHSA-7W85-PP86-P4PQ...

org.dataone.dspace:auto-versioning-xmlui (>=5.4.0, <=5.4.2), org.dspace.modules:xmlui (>=4.0, <=6.3) potentially affected by CVE-2022-31190 via org.dspace:dspace-xmlui (>=4.0, <=6.3)

org.dspace:dspace-xmlui MAVEN version =4.0, =5.4.0, =4.0, =6.3 Source cves: CVE-2022-31190 Source advisory: OSV:GHSA-7W85-PP86-P4PQ...

Grafana -- Plugin signature bypass

Grafana Labs reports: On July 4th as a result of an internal security audit we have discovered a bypass in the plugin signature verification by exploiting a versioning flaw. We believe that this vulnerability is rated at CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L...

Office 365 Config Loophole Opens OneDrive, SharePoint Data to Ransomware Attack

Researchers are warning attackers can abuse Microsoft Office 365 functionality to target files stored on SharePoint and OneDrive in ransomware attacks. Those files, stored via “auto-save” and backed-up in the cloud, typically leave end users with the impression data is shielded from a ransomware...

A Microsoft Office 365 Feature Could Help Ransomware Hackers Hold Cloud Files Hostage

A "dangerous piece of functionality" has been discovered in Microsoft 365 suite that could be potentially abused by a malicious actor to mount attacks on cloud infrastructure and ransom files stored on SharePoint and OneDrive. The cloud ransomware attack makes it possible to launch file-encryptin...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21691 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21691...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21690 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21690...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21689 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21689...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2021-21603 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2021-21603...

appian-locust (>=0.0.2, <=1.7.0), exact-sync (>=0.0.39, <=0.0.41) +2 more potentially affected by CVE-2020-28364 via locust (>=1.0.0, <=1.1.0)

locust PYPI version =1.0.0, =0.0.2, =0.0.39, =0.0.29, =0.4.0, =0.5.0 Source cves: CVE-2020-28364 Source advisory: OSV:GHSA-VQXW-9PG7-V7V9...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2020-2230 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2020-2230...

me.leejay.jenkins:date-parameter (>=0.0.1, <=0.0.4), org.jenkins-ci.main:jenkins-test-harness (1.614) +6 more potentially affected by CVE-2019-10353 via org.jenkins-ci.main:jenkins-core (1.614)

org.jenkins-ci.main:jenkins-core MAVEN version 1.614 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - me.leejay.jenkins:date-parameter =0.0.1, =2.3.1, =1.0, =1.8, =1.10 Source cves: CVE-2019-10353...