CVE-2018-1000008

Improper Restriction of XML External Entity Reference in maven/org.jvnet.hudson.plugins/pmd

Identifiers

GHSA-687x-269m-7cv9, CVE-2018-1000008

Package Slug

maven/org.jvnet.hudson.plugins/pmd

Vulnerability

Improper Restriction of XML External Entity Reference

Description

Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

Affected Versions

All versions up to 3.49

Solution

Upgrade to version 3.50 or above.

Last Modified

2024-01-31

source