-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parser configuration in the Robot Framework Plugin. The commit diff shows the critical fix was adding 'factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE)' in RobotParser.java. The vulnerable versions lacked this protection, allowing external entity processing. The invoke method in RobotParserCallable is responsible for parsing XML input files during the 'Publish Robot Framework' step, making it the entry point for XXE exploitation. The added test case 'xxe_output.xml' and corresponding exception test confirm this was the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:robot | maven | < 2.0.1 | 2.0.1 |