Skip to content
OpenAdvisories
Medium · 6.5 CVE-2020-2298 EUVD-2022-5557GHSA-wcrg-92wp-4h28

XXE vulnerability in Jenkins Nerrvana Plugin

Published Oct 8, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Nerrvana Plugin Package: org.jenkins-ci.plugins:nerrvana-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Nerrvana Plugin unspecified – ≤ 1.02.06 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:nerrvana-plugin <= 1.02.06 — GHSA-wcrg-92wp-4h28

References