CVE-2015-5319: XEE
The following flaw was found in Jenkins:
When creating a job using the create-job CLI command, external entities are not discarded (nor processed). If these job configurations are processed by another user with an XML-aware tool (e.g. using get-job/update-job), information from that user's computer may be disclosed to Jenkins and the attacker.
Exploiting this flaw requires a high degree of specific user interaction, and the limited information that can be gained this way.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
Other sources
XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an "XML-aware tool," as demonstrated by get-job and update-job.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5319?
CVE-2015-5319 is classified as a medium severity vulnerability.
How do I fix CVE-2015-5319?
To fix CVE-2015-5319, upgrade Jenkins to version 1.638 or later, or to LTS version 1.625.2 or later.
Who is affected by CVE-2015-5319?
CVE-2015-5319 affects Jenkins versions prior to 1.638 and LTS versions before 1.625.2.
What kind of attack does CVE-2015-5319 enable?
CVE-2015-5319 allows remote attackers to read arbitrary files through an XML external entity injection.
What components of Jenkins are impacted by CVE-2015-5319?
The create-job CLI command in Jenkins is impacted by CVE-2015-5319.