CVE-2019-16549: XEE
First published: Tue Dec 17 2019(Updated: )
Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. While Jenkins users without Overall/Administer permission are not allowed to configure a custom Nexus URL, this could still be exploited via man-in-the-middle attacks, especially if it’s not an HTTPS URL. Additionally, a connection test form validation method does not require POST requests, resulting in a cross-site request forgery vulnerability. Combined, these two vulnerabilities allow attackers to have Jenkins parse crafted XML documents that use external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks. Maven Release Plug-in Plugin 0.16.2 configures its XML parser to prevent XML external entity (XXE) attacks. It also now requires that requests to the connection test form validation method are done via POST, which protects from cross-site request forgery attacks.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins.m2release:m2release | <=0.16.1 | 0.16.2 |
| Jenkins | <=0.16.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/12/17/1
- https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681
- https://nvd.nist.gov/vuln/detail/CVE-2019-16549
- https://github.com/advisories/GHSA-7mf5-79gv-66gh (Advisory)
- https://github.com/jenkinsci/m2release-plugin/commit/1e4d6fee2eab16e7a396b6d3d5f10a87e5c29cc2
Frequently Asked Questions
What is the severity of CVE-2019-16549?
CVE-2019-16549 is classified as a medium severity vulnerability due to its risk of XML external entity attacks.
How do I fix CVE-2019-16549?
To mitigate CVE-2019-16549, upgrade the Jenkins Maven Release Plugin to version 0.16.2 or later.
Which versions are affected by CVE-2019-16549?
CVE-2019-16549 affects Jenkins Maven Release Plugin versions up to and including 0.16.1.
Can CVE-2019-16549 be exploited without admin access?
Yes, CVE-2019-16549 can be exploited by users without Overall/Administer permission, making it critical to update.
What kind of attacks can CVE-2019-16549 lead to?
CVE-2019-16549 can lead to XML external entity (XXE) attacks, potentially exposing sensitive information.
- collector/github-advisory
- alias/GHSA-7mf5-79gv-66gh
- alias/CVE-2019-16549
- collector/github-advisory-latest
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-cve
- package-manager/maven
- vendor/jenkins
- canonical/jenkins
- version/jenkins/0.16.1