CVE-2019-10309 - Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients

Back Back to CVE browser

CRITICAL

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients

Published Apr 30, 2019

9.3

CRITICAL

CVSS 3.0

EPSS 1.79%

Description

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.

Affected products

Vendor Jenkins project Product Jenkins Self-Organizing Swarm Plug-in Modules Plugin Default
n/a
- Version
  3.15 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Self-Organizing Swarm Plug-in Modules Plugin

n/a

Version	Status	Constraints
3.15 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (7)

http://www.openwall.com/lists/oss-security/2019/04/30/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/108159
vdb-entryx_refsource_BID
https://github.com/advisories/GHSA-w898-3ph8-5pgm
Advisory
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10309
https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
x_refsource_MISC

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/04/30/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/108159		vdb-entryx_refsource_BID
https://github.com/advisories/GHSA-w898-3ph8-5pgm		Advisory
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10309
https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783		x_refsource_MISC