CVE-2023-37942

Name

CVE-2023-37942

Description

Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
MISC	https://www.jenkins.io/security/advisory/2023-07-12/#SECURITY-3133
MISC	http://www.openwall.com/lists/oss-security/2023/07/12/2

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:jenkins:external_monitor_job_type::::::jenkins::*`	jenkins	>= None	<= 206.v9a_94ff0b_4a_10

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status
jenkins	3.18-community	2.387.3-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	3.19-community	2.440.3-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	3.20-community	2.440.2-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	edge-community	2.479.1-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable