XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin

보통 6.5CVE-2018-1000198 · GHSA-8rc4-3jc3-83pm · Published 05/06/2018 · updated 17/06/2026

요약

CVE-2018-1000198은(는) com.blackducksoftware.integration:blackduck-hub, black duck hub (jenkins)에 영향을 주는 보통 (CVSS 6.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.95%, 전체 취약점의 61.6%보다 높음.
조치: 4.0.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
com.blackducksoftware.integration:blackduck-hub Maven	`< 4.0.0`	`4.0.0`
black duck hub jenkins	`≤ 3.1.0`	No fix yet

Description

A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000198 · ADVISORY
jenkins.io/security/advisory/2018-05-09 · WEB

com.blackducksoftware.integration:blackduck-hub의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.blackducksoftware.integration:blackduck-hub

Maven

< 4.0.0

4.0.0

black duck hub

jenkins

≤ 3.1.0

No fix yet

Description

NVD description

com.blackducksoftware.integration:blackduck-hub의 다른 취약점

모두 보기 →