CVE-2018-1000198: Jenkins Black Duck Hub

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers with Overall/Read permission to make Jenkins process XML eternal entities in an XML document.

Affected products

• Jenkins Black Duck Hub: up to and including 3.1.0

Published 2018-06-05. Last modified 2026-06-17.