Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:junit
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2018-1000054
CVE-2018-1000055
CVE-2018-1000056
CWE: CWE-611
CVSS: 8.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.


Mitigations:

Architectural layers (MAESTRO):