CVE-2019-16549: XEE
Jenkins Maven Release Plug-in Plugin retrieves XML from Nexus repository manager APIs. Maven Release Plug-in Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. While Jenkins users without Overall/Administer permission are not allowed to configure a custom Nexus URL, this could still be exploited via man-in-the-middle attacks, especially if it’s not an HTTPS URL.
Additionally, a connection test form validation method does not require POST requests, resulting in a cross-site request forgery vulnerability. Combined, these two vulnerabilities allow attackers to have Jenkins parse crafted XML documents that use external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.
Maven Release Plug-in Plugin 0.16.2 configures its XML parser to prevent XML external entity (XXE) attacks. It also now requires that requests to the connection test form validation method are done via POST, which protects from cross-site request forgery attacks.
Other sources
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16549?
CVE-2019-16549 is classified as a medium severity vulnerability due to its risk of XML external entity attacks.
How do I fix CVE-2019-16549?
To mitigate CVE-2019-16549, upgrade the Jenkins Maven Release Plugin to version 0.16.2 or later.
Which versions are affected by CVE-2019-16549?
CVE-2019-16549 affects Jenkins Maven Release Plugin versions up to and including 0.16.1.
Can CVE-2019-16549 be exploited without admin access?
Yes, CVE-2019-16549 can be exploited by users without Overall/Administer permission, making it critical to update.
What kind of attacks can CVE-2019-16549 lead to?
CVE-2019-16549 can lead to XML external entity (XXE) attacks, potentially exposing sensitive information.