CVE-2020-2138 – Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML pars

Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2138

Reference (s):

• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1700
• MLIST:[oss-security] 20200309 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/03/09/1