GCVE - cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jenkins:token_macro:*:*:*:*:*:jenkins:*:*

part: a version: * update: *

Vendor	Jenkins (`d708d718-2e77-5ca3-ae9c-38ee4d256744`)
Product	Token Macro (`5aad6bb3-686a-53cd-ab17-70031528882d`)
Edition	*
Language	*
Software edition	*
Target software	jenkins
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-10337`	vulnerable	2026-06-08 05:12:23.178140	Details available An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Published: 2019-06-11T13:15:27.000Z Updated: 2024-08-04T22:17:20.365Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2019/06/11/1 http://www.securityfocus.com/bid/108747 https://access.redhat.com/errata/RHSA-2019:1636 https://access.redhat.com/errata/RHSA-2019:1851 https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1003011`	vulnerable	2026-06-08 05:12:21.403190	Details available An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation. Published: 2019-02-06T16:00:00.000Z Updated: 2024-08-05T03:00:19.329Z Open on db.gcve.eu Reference links https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102 https://access.redhat.com/errata/RHBA-2019:0326 https://access.redhat.com/errata/RHBA-2019:0327	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.