netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8j88-2hfc-5rf3
GHSA-qgm7-m77f-j8pf
This commit is contained in:
advisory-database[bot]
2023-04-10 16:31:15 +00:00
parent fcb0c5201f
commit cb4f357fb7
2 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/04/GHSA-8j88-2hfc-5rf3/GHSA-8j88-2hfc-5rf3.json
+6 -3
View File
@@ -1,15 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8j88-2hfc-5rf3",
"modified": "2023-04-03T22:53:56Z",
"modified": "2023-04-10T16:30:42Z",
"published": "2023-04-02T21:30:17Z",
"aliases": [
"CVE-2023-28681"
],
"summary": "Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks",
"details": "Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"details": "Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
{
advisories/github-reviewed/2023/04/GHSA-qgm7-m77f-j8pf/GHSA-qgm7-m77f-j8pf.json
+6 -3
View File
@@ -1,15 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgm7-m77f-j8pf",
"modified": "2023-04-03T22:55:48Z",
"modified": "2023-04-10T16:29:54Z",
"published": "2023-04-02T21:30:16Z",
"aliases": [
"CVE-2023-28682"
],
"summary": "Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks",
"details": "Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control PerfPublisher report files to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"details": "Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control PerfPublisher report files to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
{