CVE-2015-1811: XEE
First published: Wed Mar 25 2015(Updated: )
This vulnerability allows attackers to create malicious XML documents and feed that into Jenkins, which causes Jenkins to retrieve arbitrary XML document on the server, resulting in the exposure of sensitive information inside/outside Jenkins. External References: <a href="https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27">https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Cloudbees | <1.596.1 | |
| Jenkins Cloudbees | <1.600 | |
| maven/org.jenkins-ci.main:jenkins-core | <1.596.1 | 1.596.1 |
| maven/org.jenkins-ci.main:jenkins-core | >=1.597<1.600 | 1.600 |
| <1.596.1 | ||
| <1.600 | ||
| redhat/Jenkins | <1.600 | 1.600 |
| redhat/Jenkins | <1.596.1 | 1.596.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1205637
- https://rhn.redhat.com/errata/RHSA-2015-1844.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1205632
- https://jenkins.io/security/advisory/2015-02-27/
- https://nvd.nist.gov/vuln/detail/CVE-2015-1811
- https://github.com/advisories/GHSA-qg7x-4h4q-3m49 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2015-1811?
CVE-2015-1811 is considered a high severity vulnerability due to its ability to expose sensitive information.
How do I fix CVE-2015-1811?
To fix CVE-2015-1811, upgrade Jenkins to a version above 1.600 or 1.596.1 depending on the specific build you are using.
What impact does CVE-2015-1811 have on Jenkins users?
CVE-2015-1811 allows attackers to exploit Jenkins by processing malicious XML, potentially leading to unauthorized data exposure.
Which versions of Jenkins are affected by CVE-2015-1811?
CVE-2015-1811 affects Jenkins versions below 1.596.1 and 1.600.
Is there a workaround for CVE-2015-1811?
There is no specific workaround for CVE-2015-1811; updating to a patched version is the recommended action.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qg7x-4h4q-3m49
- alias/CVE-2015-1811
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/author
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- agent/event
- collector/nvd-cve
- source/NVD
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins cloudbees
- package-manager/maven
- package-manager/redhat