VULNERABILITY INTELLIGENCE

CVE-2026-57303

CVSS score7.1 HIGH
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-06-24
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-918

Primary references