CVE-2015-1811: XEE
First published: Wed Mar 25 2015(Updated: )
This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins. External References: <a href="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Cloudbees | <1.596.1 | |
| Jenkins Cloudbees | <1.600 | |
| maven/org.jenkins-ci.main:jenkins-core | <1.596.1 | 1.596.1 |
| maven/org.jenkins-ci.main:jenkins-core | >=1.597<1.600 | 1.600 |
| <1.596.1 | ||
| <1.600 | ||
| redhat/Jenkins | <1.600 | 1.600 |
| redhat/Jenkins | <1.596.1 | 1.596.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1205637
- https://rhn.redhat.com/errata/RHSA-2015-1844.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1205632
- https://jenkins.io/security/advisory/2015-02-27/
- https://nvd.nist.gov/vuln/detail/CVE-2015-1811
- https://github.com/advisories/GHSA-qg7x-4h4q-3m49 (Advisory)
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qg7x-4h4q-3m49
- alias/CVE-2015-1811
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/author
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- vendor/jenkins
- canonical/jenkins cloudbees
- package-manager/maven
- package-manager/redhat