CVE-2018-1000009: XEE
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000009?
CVE-2018-1000009 has a high severity rating due to its potential to allow attackers to extract sensitive information from the Jenkins master.
How do I fix CVE-2018-1000009?
To fix CVE-2018-1000009, upgrade the Jenkins Checkstyle Plugin to version 3.50 or later.
Who is affected by CVE-2018-1000009?
CVE-2018-1000009 affects users of Jenkins with the Checkstyle Plugin version 3.49 and earlier.
What types of attacks can occur due to CVE-2018-1000009?
CVE-2018-1000009 can enable secret extraction, server-side request forgery, and denial-of-service attacks.
Is there a workaround for CVE-2018-1000009?
There isn't a specific workaround for CVE-2018-1000009; the best action is to upgrade the affected plugin.