CVE-2019-1003015 XXE vulnerability in Jenkins Job Import Plugin

What is CVE-2019-1003015?

CVE-2019-1003015 is a critical vulnerability in Jenkins Job Import Plugin, published on 6 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.

Weakness: CWE-611

Which versions are affected by CVE-2019-1003015?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:job-import-plugin. It affects 1 product.

Products include Jenkins Job Import.

How do I fix CVE-2019-1003015?

Upgrade org.jenkins-ci.plugins:job-import-plugin to 3.0 or later.

Is CVE-2019-1003015 being exploited?

There is no known exploitation of CVE-2019-1003015 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Job Import Plugin

• CVE-2019-1003016 Jenkins Job Import Plugin vulnerable to exposure of sensitive information High 8.8
• CVE-2019-1003017 Jenkins Job Import Plugin CSRF vulnerability Medium 5.3
• CVE-2026-48926 Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint Medium 4.3
• CVE-2022-43413 Jenkins Job Import Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-882r-r8fw-p538.