PT-2020-15382 · Jenkins · Jenkins Code Coverage Api Plugin+1

Federico Pellegrin · Published 2020-04-07 · Updated 2023-10-25 · CVE-2020-2172

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Code Coverage API Plugin versions 1.1.4 and earlier

Description The issue allows a user who can control the input files for the "Publish Coverage Report" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

Recommendations For Jenkins Code Coverage API Plugin versions 1.1.4 and earlier, update to version 1.1.5 or later, which disables external entity resolution for its XML parser. As a temporary workaround, consider restricting access to the "Publish Coverage Report" post-build step to minimize the risk of exploitation.

Fix

XXE

XML Entity Expansion

Weakness Enumeration

CWE-611

CWE-776

Related Identifiers

CVE-2020-2172

GHSA-CMGM-Q8HF-P7JC

Affected Products

Jenkins

Jenkins Code Coverage Api Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-2172 · Security Note
• https://osv.dev/vulnerability/GHSA-cmgm-q8hf-p7jc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2172 · Vendor Advisory
• https://github.com/jenkinsci/code-coverage-api-plugin · Note
• https://github.com/jenkinsci/code-coverage-api-plugin/commit/f0ef84c25f7bc4de4e722e994de57d238225834c · Note
• https://t.me/cvenotify/2474 · Telegram Post
• https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1699 · Note
• http://openwall.com/lists/oss-security/2020/04/07/3 · Note