What is GHSA-wf8m-qr47-xc9m?

GHSA-wf8m-qr47-xc9m is a security advisory published by GitHub Security Advisories with High severity. Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Which CVE IDs does GHSA-wf8m-qr47-xc9m cover?

GHSA-wf8m-qr47-xc9m covers the following CVE IDs: CVE-2023-28685. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wf8m-qr47-xc9m?

GHSA-wf8m-qr47-xc9m has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-wf8m-qr47-xc9m?

GHSA-wf8m-qr47-xc9m affects 1 product, including: maven/org.jenkins-ci.plugins:absint-a3:\u003c= 1.1.0.

GHSA-wf8m-qr47-xc9mHighCVSS 7.1

Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

Vendor

GitHub Security Advisories

Published

July 6, 2023

Last Modified

July 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-28685 →

📋 Description

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control Project File (APX) contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

🎯 Affected products1

maven/org.jenkins-ci.plugins:absint-a3:<= 1.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-28685
https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2930
https://github.com/advisories/GHSA-wf8m-qr47-xc9m