CVE-2020-2120 – Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parse

Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2120

Reference (s):

• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1751
• MLIST:[oss-security] 20200212 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/02/12/3