What is GHSA-x7qf-qh3r-mx22?

GHSA-x7qf-qh3r-mx22 is a security advisory published by GitHub Security Advisories with High severity. XXE vulnerability in Jenkins DRY Plugin

Which CVE IDs does GHSA-x7qf-qh3r-mx22 cover?

GHSA-x7qf-qh3r-mx22 covers the following CVE IDs: CVE-2018-1000010. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x7qf-qh3r-mx22?

GHSA-x7qf-qh3r-mx22 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-x7qf-qh3r-mx22?

GHSA-x7qf-qh3r-mx22 affects 1 product, including: maven/org.jvnet.hudson.plugins:dry:\u003c= 2.49.

GHSA-x7qf-qh3r-mx22HighCVSS 8.8

XXE vulnerability in Jenkins DRY Plugin

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000010 →

📋 Description

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

🎯 Affected products1

maven/org.jvnet.hudson.plugins:dry:<= 2.49

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000010
https://jenkins.io/security/advisory/2018-01-22/
https://github.com/advisories/GHSA-x7qf-qh3r-mx22