Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-10327

CVE-2019-10327: XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin

8.1

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-10327
GHSA ID
GHSA-6755-jgp4-8q7h
EPSS Score
0.36217%
CWE
CWE-611
Published
5/24/2022
Updated
12/19/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:pipeline-mavenmaven< 3.7.13.7.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from insecure XML parsing configuration in MavenSpyLogProcessor.java. The patch explicitly adds XXE protections: 1) disables DTD processing, 2) enables secure processing feature, 3) disables external entities, and 4) adds a restrictive entity resolver. The original code lacked these protections, making the DocumentBuilder initialization in processMavenSpyLogs() the vulnerable point. The direct correlation between the patch's security hardening and CWE-611 confirms this assessment.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n XML *xt*rn*l *ntiti*s (XX*) vuln*r**ility in J*nkins Pip*lin* M*v*n Int**r*tion Plu*in *.*.* *n* **rli*r *llow** *tt**k*rs **l* to *ontrol * t*mpor*ry *ir**tory's *ont*nt on t** ***nt runnin* t** M*v*n *uil* to **v* J*nkins p*rs* * m*li*iously *r*

Reasoning

T** vuln*r**ility st*mm** *rom ins**ur* XML p*rsin* *on*i*ur*tion in `M*v*nSpyLo*Pro**ssor.j*v*`. T** p*t** *xpli*itly ***s XX* prot**tions: *) *is**l*s *T* pro**ssin*, *) *n**l*s s**ur* pro**ssin* ***tur*, *) *is**l*s *xt*rn*l *ntiti*s, *n* *) ***s