What is GHSA-882r-r8fw-p538?

GHSA-882r-r8fw-p538 is a security advisory published by GitHub Security Advisories with Critical severity. XXE vulnerability in Jenkins Job Import Plugin

Which CVE IDs does GHSA-882r-r8fw-p538 cover?

GHSA-882r-r8fw-p538 covers the following CVE IDs: CVE-2019-1003015. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-882r-r8fw-p538?

GHSA-882r-r8fw-p538 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-882r-r8fw-p538?

GHSA-882r-r8fw-p538 affects 1 product, including: maven/org.jenkins-ci.plugins:job-import-plugin:\u003c 3.0.

GHSA-882r-r8fw-p538CriticalCVSS 9.1

XXE vulnerability in Jenkins Job Import Plugin

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

October 25, 2023

🔗 CVE IDs covered (1)

CVE-2019-1003015 →

📋 Description

An XML external entity (XXE) processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.

🎯 Affected products1

maven/org.jenkins-ci.plugins:job-import-plugin:< 3.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-1003015
https://jenkins.io/security/advisory/2019-01-28/#SECURITY-905%20(1)
https://github.com/advisories/GHSA-882r-r8fw-p538