CVE-2018-1000054: Improper Restriction of XML External Entity Reference

February 9, 2018 (updated March 13, 2018)

Jenkins CCM Plugin processes XML external entities in parsed files as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

References

jenkins.io/security/advisory/2018-02-05/
nvd.nist.gov/vuln/detail/CVE-2018-1000054

Code Behaviors & Features

Detect and mitigate CVE-2018-1000054 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →