CVE-2020-2144 – Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parse

Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2144

Reference (s):

• https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1702
• MLIST:[oss-security] 20200309 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/03/09/1