CVE-2023-41933

Name

CVE-2023-41933

Description

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

References

Type	URI
MISC	https://www.jenkins.io/security/advisory/2023-09-06/#SECURITY-3235
MISC	http://www.openwall.com/lists/oss-security/2023/09/06/9

Match rules

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:jenkins:job_configuration_history::::::jenkins::*`	jenkins	>= None	<= 1229.v3039470161a_d

Vulnerable and fixed packages

Source package	Branch	Version	Maintainer	Status
jenkins	3.18-community	2.387.3-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	3.19-community	2.440.3-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	3.20-community	2.440.2-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable
jenkins	edge-community	2.479.1-r0	Francesco Colista <fcolista@alpinelinux.org>	possibly vulnerable