GHSA-f5wx-w2f9-82ghHighCVSS 7.6

XXE vulnerability in Jenkins WebSphere Deployer Plugin

Published
May 24, 2022
Last Modified
January 28, 2023

🔗 CVE IDs covered (1)

CVE-2020-2108 →

📋 Description

WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a WEB-INF/ibm-web-ext.xml which is parsed by the plugin.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:websphere-deployer:<= 1.6.1

🔗 References (4)