CVE-2020-2324 – Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2324

Reference (s):

• https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146
• URL: https://www.jenkins.io/security/advisory/2020-12-03/#SECURITY-2146
• MLIST:[oss-security] 20201203 Multiple vulnerabilities in Jenkins
• URL: http://www.openwall.com/lists/oss-security/2020/12/03/2