CVE-2023-37942
Jenkins External Monitor Job Type Plugin XML external entity vulnerability
6.5
MEDIUM
CVSS 3.1
EPSS 0.31%
Description
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. External Monitor Job Type Plugin 207.v98a_a_37a_85525 disables external entity resolution for its XML parser.
How to fix CVE-2023-37942
To remediate CVE-2023-37942, upgrade the affected package to a fixed version below.
- —upgrade to 207.v98a or later
Is CVE-2023-37942 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 207.v98a
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |