CVE-2018-1000056: Server-Side Request Forgery (SSRF)

May 14, 2022 (updated June 30, 2022)

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

References

github.com/advisories/GHSA-4rj6-9pjh-882r
github.com/jenkinsci/junit-plugin/commit/15f39fc49d9f25bca872badb48e708a8bb815ea7
jenkins.io/security/advisory/2018-02-05/
nvd.nist.gov/vuln/detail/CVE-2018-1000056

Code Behaviors & Features

Detect and mitigate CVE-2018-1000056 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →