LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1000055: Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of t...

Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Jenkins environments using Android Lint Plugin 2.5 or earlier may let a Jenkins user abuse build-time XML parsing to read secrets, reach internal services, or cause denial of service. The business risk is highest where less-trusted users can configure builds or influence parsed XML files.

Executive priority

Prioritize remediation where Jenkins is shared with contractors, developers, or automation users who are not fully trusted. The issue can affect secrets and internal systems, but evidence provided does not show active exploitation.

Technical view

The plugin processes XML external entities in files parsed during builds. That XXE behavior can enable secret extraction from the Jenkins master, server-side request forgery, or denial of service. The bundle identifies Android Lint Plugin 2.5 and earlier; no CVSS score, CWE, or specific fixed version is included.

Likely exposure

Exposure is limited to Jenkins instances with Android Lint Plugin 2.5 or earlier, especially where users beyond trusted administrators have Jenkins permissions or can affect build inputs parsed by the plugin.

Exploitation context

The source states an attacker needs user permissions in Jenkins. The bundle does not cite active exploitation, KEV listing, public exploit status, or internet-wide exploitation evidence.

Researcher notes

Treat this as an authenticated XXE in Jenkins build processing. Validate plugin version and trust boundaries around build files. Evidence is incomplete on patch version and exploit activity, so anchor remediation to Jenkins advisory details.

Mitigation direction

  • Check Jenkins advisory guidance for the fixed or recommended plugin version.
  • Upgrade Android Lint Plugin if Jenkins guidance identifies a fixed release.
  • Disable or remove the plugin if it is not operationally required.
  • Restrict Jenkins user permissions for job configuration and build input control.
  • Review Jenkins master secrets potentially exposed before remediation.

Validation and detection

  • Inventory Jenkins instances for Android Lint Plugin installations.
  • Confirm whether installed versions are 2.5 or earlier.
  • Review who can configure jobs or influence Android Lint build inputs.
  • Check for unusual Jenkins master secret access or internal service requests.
  • Document remediation status against Jenkins advisory guidance.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Cloud metadata behavior lookup

The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2018-1000055 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.