-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in HTTP request handlers and build data deserialization. The advisory explicitly states the patched version 'disables external entity resolution for its XML parser', indicating the vulnerable code paths involve XML processing without FEATURE_SECURE_PROCESSING or explicit entity disabling. The doSubmit method is the primary entry point for external job submissions, while readFromStream handles build data persistence - both would require XML parser configuration changes as described in the security advisory. Confidence is high for the HTTP handler method due to direct attacker control, and medium for the deserialization method based on typical plugin architecture.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:external-monitor-job | maven | < 207.v98a | 207.v98a |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report