CVE-2026-57303: Assembla: sunucu taraflı istek sahteciliği (SSRF)

Açıklama (NVD)

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

Özet bilgiler

Ürün

Jenkins Assembla

CVSS v3.1

7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

%0,36 (yüzdelik 30)

CWE

CWE-918

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• www.jenkins.io
• CWE-918