CVE-2019-10327: XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
Summary
CVE-2019-10327: XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin. Affects org.jenkins-ci.plugins:pipeline-maven versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pipeline Maven Integration Jenkins Plugin is a plugin for the Jenkins automation server that allows users to integrate Maven builds into their Jenkins pipelines. It provides functionality for managing and executing Maven builds within Jenkins. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The plugin is affected by an XML external entities (XXE) vulnerability. This vulnerability allows attackers who can control the content of a temporary directory on the agent running the Maven build to exploit Jenkins by parsing a maliciously crafted XML file. The attacker can use external entities to extract secrets from the Jenkins master, perform server-side request forgery, or launch denial-of-service attacks. The vulnerability has a CVSS score of 8.1, indicating a high severity.
How To Fix
Minimum fixed version
3.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the plugin as soon as possible.
Conclusion
The Pipeline Maven Integration Jenkins Plugin is affected by an XML external entities vulnerability that can be exploited by attackers to extract secrets, perform server-side request forgery, or launch denial-of-service attacks. Users should upgrade to version 3.7.1 or later of the plugin to fix the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:pipeline-maven →
FAQ
The vulnerability allows attackers to extract secrets from the Jenkins master, perform server-side request forgery, or launch denial-of-service attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it in real-time.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to patch your systems to prevent potential attacks.
Yes, a fix is available in version 3.7.1 of the Pipeline Maven Integration Jenkins Plugin. It is recommended to upgrade to this version or later to mitigate the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the latest version of the plugin is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:pipeline-maven.
