CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 1CVE-2021-26291 – block repositories using http by default
https://notcve.org/view.php?id=CVE-2021-26291
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html Apache Maven seguirá los repositorios que se definen en el Project Object Model (pom) de una dependencia, lo que puede resultar sorprendente para algunos usuarios, resultando en un riesgo potencial si un actor malicioso se hace cargo de ese repositorio o es capaz de insertarse en una posición para fingir ser ese repositorio. • http://www.openwall.com/lists/oss-security/2021/04/23/5 https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8aff5ee9bac7854d64736%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac6f06d16d139e5e1027c%40%3Cdev.maven.apache.org%3E https://lists.apache.org/thread.html/r07a89b32783f73bda6903c1f9aadeb859e5bef0a4daed6d87db8e4a9%40%3Cissues.karaf.apache.org%3E https://lists.apache.org/thread.html/r08a401f8c98a99f68d061fde6e6659d695f28d60fe4f0413bcb355b0%40%3Ccommits.druid.apache.org%3E https://lists • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-346: Origin Validation Error •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26719
https://notcve.org/view.php?id=CVE-2021-26719
A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations. Se detectó un problema de salto de directorio en Gradle gradle-enterprise-test-distribution-agent versiones anteriores a 1.3.2, test-distribution-gradle-plugin versiones anteriores a 1.3.2 y gradle-enterprise-maven-extension versiones anteriores a 1.8.2. Un actor malicioso (con determinadas credenciales) puede llevar a cabo un paso de registro de modo que los archivos TAR diseñados conlleven a una extracción de archivos en ubicaciones arbitrarias del sistema de archivos • https://security.gradle.com/advisory/CVE-2021-26719 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15777
https://notcve.org/view.php?id=CVE-2020-15777
An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). • https://docs.gradle.com/enterprise/maven-extension/#1_6 https://security.gradle.com/advisory/CVE-2020-15777 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16549
https://notcve.org/view.php?id=CVE-2019-16549
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents. Jenkins Maven Release Plugin 0.16.1 y versiones anteriores no configura el analizador XML para evitar ataques de entidad externa XML (XXE), lo que permite a los atacantes de tipo "man-in-the-middle" tener Jenkins analizando documentos XML creados. • http://www.openwall.com/lists/oss-security/2019/12/17/1 https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16550
https://notcve.org/view.php?id=CVE-2019-16550
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents. Una vulnerabilidad de tipo cross-site request forgery en un método de formulario de prueba de conexión en Jenkins Maven Release Plugin 0.16.1 y versiones anteriores permite a los atacantes que Jenkins se conecten a un servidor web especificado por el atacante y analicen documentos XML. • http://www.openwall.com/lists/oss-security/2019/12/17/1 https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681 • CWE-352: Cross-Site Request Forgery (CSRF) •