CVE-2019-10337

2019-06-1114:29:01

Google

osv.dev

6.6 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

77.9%

JSON

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the “XML” macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

CPENameOperatorVersion
token-macro-plugineqtoken-macro-1.5
token-macro-plugineqtoken-macro-1.12
token-macro-plugineqtoken-macro-2.7
token-macro-plugineqtoken-macro-2.0-beta
token-macro-plugineqtoken-macro-2.3
token-macro-plugineqtoken-macro-1.5.1
token-macro-plugineqtoken-macro-1.11
token-macro-plugineqtoken-macro-1.2
token-macro-plugineqtoken-macro-2.4
token-macro-plugineqtoken-macro-1.10

Name	Operator	Version
token-macro-plugin	eq	token-macro-1.5
token-macro-plugin	eq	token-macro-1.12
token-macro-plugin	eq	token-macro-2.7
token-macro-plugin	eq	token-macro-2.0-beta
token-macro-plugin	eq	token-macro-2.3
token-macro-plugin	eq	token-macro-1.5.1
token-macro-plugin	eq	token-macro-1.11
token-macro-plugin	eq	token-macro-1.2
token-macro-plugin	eq	token-macro-2.4
token-macro-plugin	eq	token-macro-1.10