CVE-2018-1000011

HIGH

Jenkins FindBugs Plugin < 4.71 - XML External Entity Injection in Build Process

Title source: llm

Description

Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://jenkins.io/security/advisory/2018-01-22/

Scores

CVSS v3 8.8

EPSS 0.0006

EPSS Percentile 20.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-611

Status published

Products (2)

jenkins/findbugs < 4.71

org.jvnet.hudson.plugins.findbugs/library 0Maven

Published Jan 23, 2018

Tracked Since Feb 18, 2026