Jenkins Dry vulnerabilities

2 CVEs affecting Jenkins Dry, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1000010, published 2018-01-23.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-1000010, published 2018-01-23. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the…
• CVE-2017-1000103, published 2017-10-05. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin…