CVE-2020-2247 – Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure

Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2247

Reference (s):

• https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1831
• URL: https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1831
• MLIST:[oss-security] 20200901 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/09/01/3