Jenkins Assembla Plugin
Monthly
XML external entity (XXE) injection in the Jenkins Assembla Plugin version 1.4 and earlier lets an attacker who can control the HTTP responses of the configured Assembla server read sensitive files and secrets from the Jenkins controller and pivot into internal services via server-side request forgery. Mapped to CWE-918 (SSRF) with a CVSS 3.1 base score of 7.1 (high), there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as 'none' with only partial technical impact. Exploitation requires the attacker to influence what the Assembla endpoint returns, so it is a targeted rather than mass-exploitable condition.
Cross-site request forgery in Jenkins Assembla Plugin 1.4 and earlier enables network-adjacent attackers to force an authenticated Jenkins user's session to initiate connections to attacker-controlled endpoints using attacker-supplied credentials. The plugin fails to validate CSRF tokens on its connection-triggering functionality, allowing external origins to forge legitimate-looking requests. No active exploitation has been identified (EPSS at 1st percentile, absent from CISA KEV), and SSVC assessment classifies exploitation as none with partial technical impact, placing this firmly in a lower remediation priority tier.
Jenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allowing any Jenkins user holding only Overall/Read permission to trigger outbound HTTP connections to an arbitrary attacker-controlled URL with attacker-supplied credentials. This enables both a limited Server-Side Request Forgery (SSRF) vector for internal network probing and credential interception on the attacker's endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none.
XML external entity (XXE) injection in the Jenkins Assembla Plugin version 1.4 and earlier lets an attacker who can control the HTTP responses of the configured Assembla server read sensitive files and secrets from the Jenkins controller and pivot into internal services via server-side request forgery. Mapped to CWE-918 (SSRF) with a CVSS 3.1 base score of 7.1 (high), there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as 'none' with only partial technical impact. Exploitation requires the attacker to influence what the Assembla endpoint returns, so it is a targeted rather than mass-exploitable condition.
Cross-site request forgery in Jenkins Assembla Plugin 1.4 and earlier enables network-adjacent attackers to force an authenticated Jenkins user's session to initiate connections to attacker-controlled endpoints using attacker-supplied credentials. The plugin fails to validate CSRF tokens on its connection-triggering functionality, allowing external origins to forge legitimate-looking requests. No active exploitation has been identified (EPSS at 1st percentile, absent from CISA KEV), and SSVC assessment classifies exploitation as none with partial technical impact, placing this firmly in a lower remediation priority tier.
Jenkins Assembla Plugin 1.4 and earlier exposes a connection-test endpoint without adequate permission enforcement, allowing any Jenkins user holding only Overall/Read permission to trigger outbound HTTP connections to an arbitrary attacker-controlled URL with attacker-supplied credentials. This enables both a limited Server-Side Request Forgery (SSRF) vector for internal network probing and credential interception on the attacker's endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none.