Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nOWhnLXg5YzktN3hncs4AAmvU

XXE vulnerability in Jenkins CVS Plugin

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Jenkins CVS Plugin 2.17 disables external entity resolution for its XML parser.

Permalink: https://github.com/advisories/GHSA-g9hg-x9c9-7xgr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOWhnLXg5YzktN3hncs4AAmvU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-g9hg-x9c9-7xgr, CVE-2020-2324
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-2324
• https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146
• http://www.openwall.com/lists/oss-security/2020/12/03/2
• https://github.com/jenkinsci/cvs-plugin/commit/ff121443b282c8dbd6a5ee4841f152f78e4a5954
• https://github.com/advisories/GHSA-g9hg-x9c9-7xgr

Repository: https://github.com/jenkinsci/cvs-plugin
Blast Radius: 1.0

Affected Packages