An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mNXd4LXcyZjktODJnaM4AAjcW
XXE vulnerability in Jenkins WebSphere Deployer Plugin
WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a
WEB-INF/ibm-web-ext.xml which is parsed by the plugin.
Source: GitHub Advisory Database
Published: about 1 year ago
Updated: 4 months ago
CVSS Score: 7.6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Identifiers: GHSA-f5wx-w2f9-82gh, CVE-2020-2108
maven:org.jenkins-ci.plugins:websphere-deployerVersions: <= 1.6.1
No known fixed version