CVE-2018-1000010

Improper Restriction of XML External Entity Reference in maven/org.jvnet.hudson.plugins/dry

Identifiers

GHSA-x7qf-qh3r-mx22, CVE-2018-1000010

Package Slug

maven/org.jvnet.hudson.plugins/dry

Vulnerability

Improper Restriction of XML External Entity Reference

Description

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Affected Versions

All versions up to 2.49

Solution

Upgrade to version 2.50 or above.

Last Modified

2024-01-31

source