« Volver al listado

CVE-2015-1809

Estado: ModificadaAlta (7.5)—

XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jenkins — Cloudbees

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-1809",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "CloudBees",
          "product": "Jenkins",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.600"
            }
          ]
        },
        {
          "vendor": "CloudBees",
          "product": "Jenkins LTS",
          "versions": [
            {
              "status": "affected",
              "version": "before 1.596.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-15T19:15:12.457",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205625",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://jenkins.io/security/advisory/2015-02-27/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205625",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://jenkins.io/security/advisory/2015-02-27/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo XML external entity (XXE) en CloudBees Jenkins versiones anteriores a 1.600 y LTS versiones anteriores a 1.596.1, permite a atacantes remotos leer archivos XML arbitrarios por medio de una consulta XPath."
    }
  ],
  "lastModified": "2026-06-17T00:23:02.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jenkins:cloudbees:*:*:*:*:lts:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C84374AF-1A74-442D-B5DB-AF0A9AC70F85",
              "versionEndExcluding": "1.596.1"
            },
            {
              "criteria": "cpe:2.3:a:jenkins:cloudbees:*:*:*:*:*:jenkins:*:*",
              "vulnerable": true,
              "matchCriteriaId": "000A7DB6-8E3A-4936-A2F2-DFC6A7B5E07E",
              "versionEndExcluding": "1.600"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}