CVE-2019-10337: XEE
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.
Other sources
Token Macro Plugin did not configure its XML parser in a way that would prevent XML External Entity (XXE) processing. This allowed attackers able to control the contents of files processed with the ${XML} macro to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Token Macro Plugin no longer processes XML External Entities in XML documents.
References:
https://jenkins.io/security/advisory/2019-06-11/
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-10337?
CVE-2019-10337 is considered a high severity vulnerability due to its potential to expose sensitive information through XML external entity processing.
How do I fix CVE-2019-10337?
To fix CVE-2019-10337, update the Jenkins Token Macro Plugin to version 2.8 or later.
What impact does CVE-2019-10337 have on my Jenkins environment?
CVE-2019-10337 can allow attackers to read sensitive files from the server and extract secrets from the Jenkins agent.
Which software versions are vulnerable to CVE-2019-10337?
Versions of the Jenkins Token Macro Plugin prior to 2.8 are vulnerable to CVE-2019-10337.
Who is affected by CVE-2019-10337?
Any users of the Jenkins Token Macro Plugin versions 2.7 and earlier are affected by CVE-2019-10337.