Not rated
CVE-2020-2108 Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can…
Description
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins WebSphere Deployer Plugin 1.6 | earliest → 1.6.1 | No fix stated |
References
- jenkins.io jenkins.io
- [oss-security] 20200129 Multiple vulnerabilities in Jenkins and Jenkins plugins www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Jenkins WebSphere Deployer Plugin
The 5 CVEs of Jenkins WebSphere Deployer Plugin →
CVE-2019-16560
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to…
Not rated
CVE-2019-16561
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate…
Not rated
CVE-2019-16559
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read…
Not rated
CVE-2019-1003056
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where…
Not rated