CVE-2023-49656 Jenkins MATLAB Plugin XML External Entity vulnerability
An attacker can exploit XML external entity vulnerabilities in the Jenkins MATLAB Plugin to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49656?
CVE-2023-49656 is a critical vulnerability in Jenkins MATLAB Plugin, published on 29 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Weakness: CWE-611
Which versions are affected by CVE-2023-49656?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:matlab. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:matlab Maven | All versions | 2.11.1 |
org.jenkins-ci.plugins:matlab Maven | All versions | 2.11.1 |
Products include Jenkins Matlab.
How do I fix CVE-2023-49656?
Upgrade org.jenkins-ci.plugins:matlab to 2.11.1 or later.
Is CVE-2023-49656 being exploited?
There is no known exploitation of CVE-2023-49656 in the wild and no public exploit code.
Other vulnerabilities in Jenkins MATLAB Plugin
Sources
Also known as GHSA-82q9-88m2-4v68.