CVE-2020-2304

CWE-611 — XML External Entity (XXE)6 documents6 sources
Severity
6.5MEDIUM
EPSS
1.6%
top 18.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Subversion PluginJenkins Subversion
Timeline
PublishedNov 4
Latest updateMay 24

Description

Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_subversion_pluginunspecified — 2.13.1
▶NVDjenkins/subversion2.13.1

🔴Vulnerability Details

3
OSV
XXE vulnerability in Jenkins Subversion Plugin↗2022-05-24
▶
GHSA
XXE vulnerability in Jenkins Subversion Plugin↗2022-05-24
▶
CVEList
CVE-2020-2304: Jenkins Subversion Plugin 2↗2020-11-04
▶

📋Vendor Advisories

2
Red Hat
jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks↗2020-11-04
▶
Jenkins
Jenkins Security Advisory 2020-11-04↗2020-11-04
▶
CVE-2020-2304 (MEDIUM CVSS 6.5) | Jenkins Subversion Plugin 2.13.1 an | cvebase.io