CVE-2018-1000198: XEE
Published Jun 5, 2018
·Updated
A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.
Affected Software
2 affected componentsFixes available
maven/com.blackducksoftware.integration:blackduck-hub<=3.1.0
4.0.0
Jenkins Black Duck Hub Jenkins<=3.1.0
Event History
Jun 5, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·03:13 AM
Frequently Asked Questions
1
What is the severity of CVE-2018-1000198?
CVE-2018-1000198 has a CVSS score that indicates it has a medium severity level due to its ability to allow XML external entity processing.
2
How do I fix CVE-2018-1000198?
To fix CVE-2018-1000198, upgrade the Jenkins Black Duck Hub Plugin to version 4.0.0 or later.
3
Who is affected by CVE-2018-1000198?
Any Jenkins instance using Black Duck Hub Plugin version 3.1.0 or older is affected by CVE-2018-1000198.
4
What type of vulnerability is CVE-2018-1000198?
CVE-2018-1000198 is an XML external entity processing vulnerability.
5
What permissions are needed to exploit CVE-2018-1000198?
An attacker needs Overall/Read permission to exploit CVE-2018-1000198.