CVE-2015-5319: Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI

May 13, 2022 (updated October 31, 2025)

XML external entity (XXE) vulnerability in the create-job CLI command in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to read arbitrary files via a crafted job configuration that is then used in an “XML-aware tool,” as demonstrated by get-job and update-job.

References

access.redhat.com/errata/RHSA-2016:0070
github.com/advisories/GHSA-3j9c-cp7m-8w8g
github.com/jenkinsci/jenkins
github.com/jenkinsci/jenkins/commit/e78e9e8144f7304cf274cd4b756f458cf63a3556
nvd.nist.gov/vuln/detail/CVE-2015-5319
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Code Behaviors & Features

Detect and mitigate CVE-2015-5319 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →