-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:mercurial | maven | = 2.11 | 2.12 |
| org.jenkins-ci.plugins:mercurial | maven | = 2.10 | 2.10.1 |
| org.jenkins-ci.plugins:mercurial | maven | = 2.9 | 2.9.1 |
| org.jenkins-ci.plugins:mercurial | maven | < 2.8.1 | 2.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in the MercurialChangeLogParser class. The pre-patch implementation used Digester2 (from Apache Commons Digester) to parse XML changelogs without disabling external entity resolution. The commit diff shows a replacement of Digester with secure XMLUtils.parse() which explicitly disables XXE. The parse method was the entry point for XML processing and lacked security configurations like setFeature(XMLConstants.FEATURE_SECURE_PROCESSING) or setExpandEntityReferences(false), making it vulnerable to XXE injection.