PT-2020-15528 · Jenkins · Jenkins Nerrvana Plugin+1

Daniel Beck · Published 2020-10-08 · Updated 2023-10-25 · CVE-2020-2298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Nerrvana Plugin versions 1.02.06 and earlier

Description The issue allows attackers to have Jenkins parse crafted HTTP requests with XML data, using external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is possible due to the XML parser not being configured to prevent XML external entity (XXE) attacks. The XML parsing is also exposed as a form validation endpoint that does not require POST requests, making it vulnerable to exploitation by users without specific permissions via CSRF.

Recommendations For Jenkins Nerrvana Plugin versions 1.02.06 and earlier, consider disabling the XML parser functionality until a patch is available to prevent XXE attacks. Restrict access to the form validation endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-2298

GHSA-WCRG-92WP-4H28

Affected Products

Jenkins

Jenkins Nerrvana Plugin

References · 6

• https://jenkins.io/security/advisory/2020-10-08/#SECURITY-2097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2298 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2298 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wcrg-92wp-4h28 · Vendor Advisory
• https://github.com/jenkinsci/nerrvana-plugin · Note
• http://openwall.com/lists/oss-security/2020/10/08/5 · Note