{"id":"CVE-2019-10337","aliases":["EUVD-2022-3903","GHSA-g6h2-4x64-c59x","RHSA-2019:1636","RHSA-2019:1851"],"status":"published","title":"Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02038,"percentile":0.81246,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2019-06-11T13:15:27Z","modified":"2026-10-24T10:30:17Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:token-macro","fixed_in":["2.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:token-macro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7"},{"fixed":"2.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:token-macro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8"}]}],"versions":["1.0","1.1","1.10","1.11","1.12","1.12.1","1.13-alpha","1.2","1.3","1.4","1.5","1.5.1","1.6","1.7","1.8","1.8.1","1.9","2.0","2.0-beta","2.1","2.2","2.3","2.4","2.5","2.6","2.7"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.1561471763-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.129-1.git.0.bd4f2d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1560870549-1.el7"}]}],"bundled":3}],"products":[{"vendor":"jenkins","product":"token_macro"},{"vendor":"jenkins project","product":"jenkins token macro plugin"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/06/11/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/108747","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1636","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1851","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1399","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10337","tags":["advisory"]},{"url":"https://github.com/jenkinsci/token-macro-plugin/commit/004319f1b6e2a0f097a096b9df9dc19a5ac0d9b0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g6h2-4x64-c59x"},{"url":"https://github.com/jenkinsci/token-macro-plugin","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714054","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719782","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1636.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10320","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10320","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10328","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10328","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10328","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10337","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691107","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1851.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1002100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1002100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1002100","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2019-10337","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2019-06-11T13:15:27Z","modified":"2024-08-04T22:17:20.365Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2022-3903","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2019-06-11T13:15:27Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-g6h2-4x64-c59x","title":"Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2022-05-24T16:47:43Z","modified":"2024-05-30T14:15:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"nvd":[{"id":"CVE-2019-10337","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2019-06-11T14:29:01.057Z","modified":"2026-06-17T02:10:44.563Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"CVE-2019-10337","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2019-06-11T14:29:01.057Z","modified":"2026-10-24T10:30:17.793163359Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-g6h2-4x64-c59x","title":"Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin","description":"An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the \"XML\" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.","status":"published","published":"2022-05-24T16:47:43Z","modified":"2024-05-30T14:50:27.747968Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"RHSA-2019:1636","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins-2-plugins security update","status":"published","published":"2024-09-16T02:41:52Z","modified":"2026-06-27T10:07:34Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:1851","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-18T04:10:11Z","modified":"2026-06-27T10:07:37Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}