CVE-2020-2178 – Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure it

Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2178

Reference (s):

• https://jenkins.io/security/advisory/2020-04-16/#SECURITY-1753
• MLIST:[oss-security] 20200416 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/04/16/4