Vulnerability Description
Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Self-Organizing Swarm Modules | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/108159
- https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
- http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/108159
- https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
FAQ
What is CVE-2019-10309?
CVE-2019-10309 is a vulnerability with a CVSS score of 9.3 (CRITICAL). Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing u...
How severe is CVE-2019-10309?
CVE-2019-10309 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-10309?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Self-Organizing Swarm Modules.