XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:pipeline-maven
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-10327
CWE: CWE-611
CVSS: 8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.


Mitigations:

Architectural layers (MAESTRO):