CVE-2020-2172 – Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its

Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2172

Reference (s):

• https://jenkins.io/security/advisory/2020-04-07/#SECURITY-1699
• MLIST:[oss-security] 20200407 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/04/07/3