Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13NGc2LTh4cXAtZzkybc4AAyf9

Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control coverage report file contents for the Post to Phabricator post-build action to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Permalink: https://github.com/advisories/GHSA-w4g6-8xqp-g92m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13NGc2LTh4cXAtZzkybc4AAyf9
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS Percentage: 0.0015
EPSS Percentile: 0.51767

Identifiers: GHSA-w4g6-8xqp-g92m, CVE-2023-28683
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-28683
• https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2942
• https://github.com/advisories/GHSA-w4g6-8xqp-g92m

Blast Radius: 1.0

Affected Packages