Skip to content
OpenAdvisories
High · 7.5 CVE-2020-2324 EUVD-2022-3931GHSA-g9hg-x9c9-7xgr

XXE vulnerability in Jenkins CVS Plugin

Published Dec 3, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins CVS Plugin Package: org.jenkins-ci.plugins:cvs Category: Web / CMS Ecosystem: Maven

Description

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins CVS Plugin unspecified – ≤ 2.16 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:cvs < 2.17 2.17 GHSA-g9hg-x9c9-7xgr

References