CVE-2019-10337

{"containers": {"cna": {"affected": [{"product": "Jenkins Token Macro Plugin", "vendor": "Jenkins project", "versions": [{"status": "affected", "version": "2.7 and earlier"}]}], "descriptions": [{"lang": "en", "value": "An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T16:47:39.349Z"}, "references": [{"name": "[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"}, {"name": "108747", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/108747"}, {"name": "RHSA-2019:1636", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:1636"}, {"name": "RHSA-2019:1851", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:1851"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2019-10337", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins Token Macro Plugin", "version": {"version_data": [{"version_value": "2.7 and earlier"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-611"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"}, {"name": "108747", "refsource": "BID", "url": "http://www.securityfocus.com/bid/108747"}, {"name": "RHSA-2019:1636", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1636"}, {"name": "RHSA-2019:1851", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1851"}, {"name": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399", "refsource": "CONFIRM", "url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:17:20.365Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20190611 Multiple vulnerabilities in Jenkins plugins", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"}, {"name": "108747", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/108747"}, {"name": "RHSA-2019:1636", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:1636"}, {"name": "RHSA-2019:1851", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:1851"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"}]}]}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2019-10337", "datePublished": "2019-06-11T13:15:27.000Z", "dateReserved": "2019-03-29T00:00:00.000Z", "dateUpdated": "2024-08-04T22:17:20.365Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Jenkins Token Macro Plugin", "vendor": "Jenkins project", "versions": [{"status": "affected", "version": "2.7 and earlier"}]}], "source": "jenkinsci-cert@googlegroups.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "46CF086E-57E0-4D08-AD1E-068DE509AFEF", "versionEndIncluding": "2.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks."}, {"lang": "es", "value": "Una vulnerabilidad de entidades externas XML (XXE) en el Plugin Token Macro de Jenkins versi\u00f3n 2.7 y anteriores, permit\u00eda a los atacantes capaces de controlar el contenido del archivo de entrada de la macro \"XML\" para tener Jenkins que resolver las entidades externas, resultando en la extracci\u00f3n de secretos del agente de Jenkins, la falsificaci\u00f3n de peticiones del lado del servidor o ataques de denegaci\u00f3n de servicio."}], "id": "CVE-2019-10337", "lastModified": "2026-06-17T02:10:44.563", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-11T14:29:01.057", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"}, {"source": "jenkinsci-cert@googlegroups.com", "url": "http://www.securityfocus.com/bid/108747"}, {"source": "jenkinsci-cert@googlegroups.com", "url": "https://access.redhat.com/errata/RHSA-2019:1636"}, {"source": "jenkinsci-cert@googlegroups.com", "url": "https://access.redhat.com/errata/RHSA-2019:1851"}, {"source": "jenkinsci-cert@googlegroups.com", "tags": ["Vendor Advisory"], "url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2019/06/11/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/108747"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:1636"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2019:1851"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2019:1851", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "atomic-openshift-0:3.11.129-1.git.0.bd4f2d5.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-07-24T00:00:00Z"}, {"advisory": "RHSA-2019:1851", "cpe": "cpe:/a:redhat:openshift:3.11::el7", "package": "jenkins-2-plugins-0:3.11.1560870549-1.el7", "product_name": "Red Hat OpenShift Container Platform 3.11", "release_date": "2019-07-24T00:00:00Z"}, {"advisory": "RHSA-2019:1636", "cpe": "cpe:/a:redhat:openshift:4.1::el7", "package": "jenkins-2-plugins-0:4.1.1561471763-1.el7", "product_name": "Red Hat OpenShift Container Platform 4.1", "release_date": "2019-07-03T00:00:00Z"}], "bugzilla": {"description": "jenkins-plugin-token-macro: XML External Entity processing the ${XML} macro", "id": "1719782", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1719782"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L", "status": "verified"}, "cwe": "CWE-611", "details": ["An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks."], "name": "CVE-2019-10337", "package_state": [{"cpe": "cpe:/a:redhat:openshift:3.10", "fix_state": "Will not fix", "package_name": "jenkins-plugin-token-macro", "product_name": "Red Hat OpenShift Container Platform 3.10"}, {"cpe": "cpe:/a:redhat:openshift:3.6", "fix_state": "Will not fix", "package_name": "jenkins-plugin-token-macro", "product_name": "Red Hat OpenShift Container Platform 3.6"}, {"cpe": "cpe:/a:redhat:openshift:3.7", "fix_state": "Will not fix", "package_name": "jenkins-plugin-token-macro", "product_name": "Red Hat OpenShift Container Platform 3.7"}, {"cpe": "cpe:/a:redhat:openshift:3.9", "fix_state": "Will not fix", "package_name": "jenkins-plugin-token-macro", "product_name": "Red Hat OpenShift Container Platform 3.9"}], "public_date": "2019-06-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-10337\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10337\nhttps://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399"], "threat_severity": "Moderate"}

{}