PT-2020-15322 · Jenkins · Jenkins Junit Plugin+1

Federico Pellegrin · Published 2020-02-12 · Updated 2023-10-25 · CVE-2020-2115

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins NUnit Plugin versions 0.25 and earlier

Description The issue allows a user who can control the input files for the post-build step to have Jenkins parse a crafted file that uses external entities. This can lead to extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks. The problem arises because the XML parser is not configured to prevent XML external entity (XXE) attacks.

Recommendations For Jenkins NUnit Plugin versions 0.25 and earlier, update to version 0.26 or later, which disables external entity processing for its XML parser.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-2115

GHSA-XVHF-Q744-5XM8

Affected Products

Jenkins

Jenkins Junit Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-xvhf-q744-5xm8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2115 · Security Note
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1752 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2115 · Vendor Advisory
• https://github.com/jenkinsci/nunit-plugin/commit/8f0b6a7b6a927c4b7003fdcd76862a3348b8205a · Note
• https://github.com/jenkinsci/nunit-plugin · Note
• http://openwall.com/lists/oss-security/2020/02/12/3 · Note