XML external entity (XXE) vulnerability in Jenkins

高危 7.5CVE-2015-1811 · GHSA-qg7x-4h4q-3m49 · Published 15/01/2020 · updated 17/06/2026

要点

CVE-2015-1811 是影响 org.jenkins-ci.main:jenkins-core, cloudbees (jenkins) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.4%，高于 72.8% 的漏洞。
修复：升级到 1.600, 1.596.1 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.597, < 1.600< 1.596.1`	`1.6001.596.1`
cloudbees jenkins	`< 1.596.1< 1.600`	`1.596.11.600`

Description

XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

NVD description

XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

References

nvd.nist.gov/vuln/detail/CVE-2015-1811 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
jenkins.io/security/advisory/2015-02-27 · WEB
jenkins.io/security/advisory/2015-02-27 · Vendor Advisory

org.jenkins-ci.main:jenkins-core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:jenkins-core

Maven

≥ 1.597, < 1.600< 1.596.1

1.6001.596.1

cloudbees

jenkins

< 1.596.1< 1.600

1.596.11.600

Description

XML external entity (XXE) vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

NVD description

XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.

org.jenkins-ci.main:jenkins-core 的其他漏洞

查看全部 →