Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2324

CVE-2020-2324: XXE vulnerability in Jenkins CVS Plugin

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2324
GHSA ID
GHSA-g9hg-x9c9-7xgr
EPSS Score
0.36063%
CWE
CWE-611
Published
5/24/2022
Updated
12/22/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:cvsmaven<= 2.162.17

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows security hardening was added to the parseFile method where XML parsing occurs. The vulnerability description explicitly states improper XML parser configuration for XXE prevention. The patched version adds critical security features (disallow-doctype-decl, external entity disabling) to the Digester instance created in this function, confirming this was the vulnerable entry point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins *VS Plu*in *.** *n* **rli*r *o*s not *on*i*ur* its XML p*rs*r to pr*v*nt XML *xt*rn*l *ntity (XX*) *tt**ks. T*is *llows *tt**k*rs **l* to *ontrol *n ***nt pro**ss to **v* J*nkins p*rs* * *r**t** ***n**lo* *il* t**t us*s *xt*rn*l *ntiti*s *or

Reasoning

T** *ommit *i** s*ows s**urity **r**nin* w*s ***** to t** `p*rs**il*` m*t*o* w**r* XML p*rsin* o**urs. T** vuln*r**ility **s*ription *xpli*itly st*t*s improp*r XML p*rs*r `*on*i*ur*tion` *or XX* pr*v*ntion. T** p*t**** v*rsion ***s *riti**l s**urity