Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2120

CVE-2020-2120: XXE vulnerability in FitNesse Plugin

7.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2120
GHSA ID
GHSA-c3cg-mv5w-cvw8
EPSS Score
0.33833%
CWE
CWE-611
Published
5/24/2022
Updated
12/13/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:fitnessemaven< 1.311.31

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure XML parser configuration in TransformerFactory instances. The patch explicitly adds 'setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)' to both locations:

  1. In ConvertReport.java's XML transformation path used for report conversion
  2. In FitnessePlugin.java's template initialization These functions were vulnerable because they created XML processors without disabling external entity resolution, a critical security setting for XXE prevention. The high confidence comes from the direct correlation between the vulnerability description (missing secure processing) and the specific functions modified in the security patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*itN*ss* Plu*in *.** *n* **rli*r *o*s not *on*i*ur* t** XML p*rs*r to pr*v*nt XML *xt*rn*l *ntity (XX*) *tt**ks. T*is *llows * us*r **l* to *ontrol t** input *il*s *or its post-*uil* st*p to **v* J*nkins p*rs* * *r**t** *il* t**t us*s *xt*rn*l *ntit

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* XML p*rs*r *on*i*ur*tion in Tr*ns*orm*r***tory inst*n**s. T** p*t** *xpli*itly ***s 's*t***tur*(XML*onst*nts.***TUR*_S**UR*_PRO**SSIN*, tru*)' to *ot* lo**tions: *. In *onv*rtR*port.j*v*'s XML tr*ns*orm*tion p*t*