CVE-2026-57303

HIGH

Jenkins Assembla Plugin < 1.4 - Server-Side Request Forgery (SSRF)

Title source: rule

Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

Jenkins Security Advisory 2026-06-24

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(1)

Scores

CVSS v3 7.1

EPSS 0.0022

EPSS Percentile 12.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (2)

jenkins/assembla < 1.4

Jenkins Project/Jenkins Assembla Plugin < 1.4

Published Jun 24, 2026

Tracked Since Jun 24, 2026