CVE-2015-1809 XML external entity (XXE) vulnerability in Jenkins
Remote attackers can read arbitrary XML files via XPath queries in Jenkins, requiring an upgrade to secure the CI server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1809?
CVE-2015-1809 is a high-severity vulnerability in CloudBees Jenkins, published on 15 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Weakness: CWE-611
Which versions are affected by CVE-2015-1809?
4 open source packages ship an affected version, including org.jenkins-ci.main:jenkins-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.main:jenkins-core Maven | All versions | 1.596.1 |
org.jenkins-ci.main:jenkins-core Maven | All versions | 1.596.1 |
org.jenkins-ci.main:jenkins-core Maven | From 1.597 | 1.600 |
org.jenkins-ci.main:jenkins-core Maven | From 1.597 | 1.600 |
Products include Jenkins Cloudbees.
How do I fix CVE-2015-1809?
Upgrade org.jenkins-ci.main:jenkins-core to a fixed version for your release line: 1.596.1 or 1.600.
Is CVE-2015-1809 being exploited?
There is no known exploitation of CVE-2015-1809 in the wild and no public exploit code.
Other vulnerabilities in CloudBees Jenkins
Sources
Also known as GHSA-qj27-w92h-fc9r.