Allele Security Alert
ASA-2019-00606
Identifier(s)
ASA-2019-00606, CVE-2019-10466, SECURITY-822
Title
XML External Entity (XXE) vulnerability
Vendor(s)
Acunetix360
Product(s)
Jenkins 360 FireLine Plugin
Affected version(s)
Jenkins 360 FireLine Plugin versions up to and including 1.7.2
Fixed version(s)
Unknown
Proof of concept
Unknown
Description
A form validation method that accepts XML does not perform permission checks. This allows users with Overall/Read permission to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins agent, server-side request forgery (SSRF), or denial-of-service attacks.
Technical details
Unknown
Credits
Thomas de Grenier de Latour
Reference(s)
Jenkins Security Advisory 2019-10-23
https://jenkins.io/security/advisory/2019-10-23/#SECURITY-822
Jenkins security advisory
https://groups.google.com/d/msg/jenkinsci-advisories/KCv6eDsiV3Y/GNr0aDC3AQAJ
oss-security – Multiple vulnerabilities in Jenkins plugins
https://www.openwall.com/lists/oss-security/2019/10/23/2
Jenkins Plugins
https://plugins.jenkins.io/acunetix-360-scan
CVE-2019-10466
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10466
CVE-2019-10466
https://nvd.nist.gov/vuln/detail/CVE-2019-10466
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: December 6, 2019