Skip to content
OpenAdvisories
High · 7.1 CVE-2020-2247 EUVD-2022-4694GHSA-p6c5-737r-2r93

XXE vulnerability in Jenkins Klocwork Analysis Plugin

Published Sep 1, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Klocwork Analysis Plugin Package: org.jenkins-ci.plugins:klocwork Category: Web / CMS Ecosystem: Maven

Description

Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Klocwork Analysis Plugin unspecified – ≤ 2020.2.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:klocwork < 2020.3.1 2020.3.1 GHSA-p6c5-737r-2r93

References