Skip to content
OpenAdvisories
High · 7.1 CVE-2020-2144 EUVD-2022-2678GHSA-5xh7-6v3x-vrhj

XXE vulnerability in Rundeck Plugin

Published Mar 9, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Rundeck Plugin Package: org.jenkins-ci.plugins:rundeck Category: Web / CMS Ecosystem: Maven

Description

Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Rundeck Plugin unspecified – ≤ 3.6.6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:rundeck < 3.6.7 3.6.7 GHSA-5xh7-6v3x-vrhj

References