netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-34j5-c4cv-mmg5
GHSA-xqpp-26pp-2365
This commit is contained in:
advisory-database[bot]
2023-10-27 14:42:32 +00:00
parent 23db2f04b6
commit 7f1bbfd20c
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-34j5-c4cv-mmg5/GHSA-34j5-c4cv-mmg5.json
+3 -3
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-34j5-c4cv-mmg5",
"modified": "2022-12-15T17:33:55Z",
"modified": "2023-10-27T14:41:43Z",
"published": "2022-05-24T19:03:11Z",
"aliases": [
"CVE-2021-21659"
],
"summary": "XXE vulnerability in Jenkins URLTrigger Plugin",
"details": "URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.\n\nURLTrigger Plugin 0.49 disables external entity resolution for its XML parser.",
"details": "Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.\n\nUJenkins RLTrigger Plugin 0.49 disables external entity resolution for its XML parser.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
advisories/github-reviewed/2022/05/GHSA-xqpp-26pp-2365/GHSA-xqpp-26pp-2365.json
+4 -4
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xqpp-26pp-2365",
"modified": "2022-12-15T17:32:32Z",
"modified": "2023-10-27T14:40:44Z",
"published": "2022-05-24T19:03:11Z",
"aliases": [
"CVE-2021-21660"
],
"summary": "XSS vulnerability in Jenkins Markdown Formatter Plugin",
"details": "Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.\n\nMarkdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.",
"details": "Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.\n\nJenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -64,7 +64,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-12-15T17:32:32Z",
"nvd_published_at": "2021-05-25T17:15:00Z"