CVE-2018-1000008

HIGH

Jenkins PMD Plugin < 3.49 - XML External Entity Injection

Title source: llm

Description

Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-01-22/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102844

Scores

CVSS v3 8.8

EPSS 0.0007

EPSS Percentile 22.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (2)

jenkins/pmd < 3.49

org.jvnet.hudson.plugins/pmd 0 - 3.50Maven

Published Jan 23, 2018

Tracked Since Feb 18, 2026