CVE-2019-10309

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.

Metrics

CVSS 3.0 9.3/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Self-Organizing Swarm Plug-in Modules Plugin	3.15 and earlier

References

http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108159
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783

Timeline

Published: Apr 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10315.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2019-103108.8A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescr CVE-2019-103118.8A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowe CVE-2019-103124.3A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowe CVE-2019-103138.8Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by use CVE-2019-103145.9Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.CVE-2019-103158.8Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF.CVE-2019-103168.8Jenkins Aqua MicroScanner Plugin 1.0.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master whe CVE-2019-103175.9Jenkins SiteMonitor Plugin 0.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.CVE-2019-103188.8Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins ma CVE-2019-103194.3A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allo CVE-2019-10325.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques