CVE-2019-10309

Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing unauthorized attackers on the same network to read arbitrary files from Swarm clients.

• CWE-611

• http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108159
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783
• http://www.openwall.com/lists/oss-security/2019/04/30/5Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108159
• https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1252Vendor Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0783

Published

Apr 30, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10303Jenkins Azure PublisherSettings Credentials Plugin 1.2 and e…8.8
• CVE-2019-10304A cross-site request forgery vulnerability in Jenkins XebiaL…
• CVE-2019-10305A missing permission check in Jenkins XebiaLabs XL Deploy Pl…6.5
• CVE-2019-10306A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4…9.9
• CVE-2019-10307A cross-site request forgery vulnerability in Jenkins Static…
• CVE-2019-10308A missing permission check in Jenkins Static Analysis Utilit…6.5
• CVE-2019-1031A cross-site-scripting (XSS) vulnerability exists when Micro…
• CVE-2019-10310A cross-site request forgery vulnerability in Jenkins Ansibl…
• CVE-2019-10311A missing permission check in Jenkins Ansible Tower Plugin 0…8.8
• CVE-2019-10312A missing permission check in Jenkins Ansible Tower Plugin 0…4.3
• CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its…8.8
• CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verificati…