CVE-2020-2120 - Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks

HIGH

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks

Published Feb 12, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.15%

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

Vendor Jenkins project Product Jenkins FitNesse Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 1.30

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins FitNesse Plugin	unknown	Affected ≥ unspecified, ≤ 1.30

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/02/12/3		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3487		Advisory
https://github.com/advisories/GHSA-c3cg-mv5w-cvw8		Advisory
https://github.com/jenkinsci/fitnesse-plugin/commit/7a913b9ff7e5a6acb0f4f4ec88d86da79db6af77
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1751		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2120