CVE-2023-37942 Jenkins External Monitor Job Type Plugin XML external entity vulnerability
Attackers can exploit XML external entity vulnerabilities in the Jenkins External Monitor Job Type Plugin to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37942?
CVE-2023-37942 is a medium-severity vulnerability in Jenkins External Monitor Job Type Plugin, published on 12 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Weakness: CWE-611
Which versions are affected by CVE-2023-37942?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:external-monitor-job. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:external-monitor-job Maven | All versions | 207.v98a |
org.jenkins-ci.plugins:external-monitor-job Maven | All versions | 207.v98a |
Products include Jenkins External Monitor Job Type.
How do I fix CVE-2023-37942?
Upgrade org.jenkins-ci.plugins:external-monitor-job to 207.v98a or later.
Is CVE-2023-37942 being exploited?
There is no known exploitation of CVE-2023-37942 in the wild and no public exploit code.
Other vulnerabilities in Jenkins External Monitor Job Type Plugin
Sources
Also known as GHSA-g4c3-4f3v-84x8.