CVE-2020-2092 - Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents

Back Back to CVE browser

HIGH

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents

Published Jan 15, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.38%

Description

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

Affected products

Vendor Jenkins project Product Jenkins Robot Framework Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 2.0.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins Robot Framework Plugin	unknown	Affected ≥ unspecified, ≤ 2.0.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4492
Advisory
https://github.com/advisories/GHSA-m53p-f25q-q6fg
Advisory
https://github.com/jenkinsci/robot-plugin/commit/a06626f516e63813db570ff9f3e9b1f76012df59
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2092

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4492		Advisory
https://github.com/advisories/GHSA-m53p-f25q-q6fg		Advisory
https://github.com/jenkinsci/robot-plugin/commit/a06626f516e63813db570ff9f3e9b1f76012df59
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2092