View source for Hudson-ci/alerts/CVE-2015-8031

{{Hudson | pageTitle = Hudson Security Advisory<br/> CVE-2015-8031}}

==CVE-2015-8031 - Hudson XML External Entity Injection==
{| class="wikitable" style="text-align: left;" | Summary for CVE-2015-8031
|-
!scope="row" style="text-align: right;" | CVE
|CVE-2015-8031 
|-
!scope="row" style="text-align: right;" | Description
|Hudson XML API External Entity Injection Vunerability
|-
!scope="row" style="text-align: right;" | Severity
|Critical 
|-
!scope="row" style="text-align: right;" | Type
|Remote Access Vulnerability
|-
!scope="row" style="text-align: right;" | Version(s) Affected
| All versions prior to 3.3.2
|-
!scope="row" style="text-align: right;" | Bugzilla Ref
| 479777  
|}
===Description===
Prior to version 3.3.2 Hudson exhibits a flaw in it's XML API processing that can allow access to potentially sensitive information on the filesystem of the Hudson master server.

===Fix===
Hudson users should upgrade to Hudson 3.3.2 or above as soon as possible

===Credits===
The Hudson Team would like to thank Luca Carettoni, Fabian Beterke and Tushar Dalvi from LinkedIn for their work in uncovering and reporting this vulnerability.