CVE-2019-10337: Improper Restriction of XML External Entity Reference

May 24, 2022 (updated August 15, 2022)

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the “XML” macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

References

www.openwall.com/lists/oss-security/2019/06/11/1
github.com/advisories/GHSA-g6h2-4x64-c59x
jenkins.io/security/advisory/2019-06-11/
nvd.nist.gov/vuln/detail/CVE-2019-10337

Detect and mitigate CVE-2019-10337 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →