CVE-2020-2315

2020-11-0415:15:12

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CPENameOperatorVersion
visualworks-store-plugineqisualworks-store-1.1.2
visualworks-store-plugineqisualworks-store-1.0
visualworks-store-plugineqisualworks-store-1.1
visualworks-store-plugineqisualworks-store-1.1.3
visualworks-store-plugineqisualworks-store-1.1.1

Name	Operator	Version
visualworks-store-plugin	eq	isualworks-store-1.1.2
visualworks-store-plugin	eq	isualworks-store-1.0
visualworks-store-plugin	eq	isualworks-store-1.1
visualworks-store-plugin	eq	isualworks-store-1.1.3
visualworks-store-plugin	eq	isualworks-store-1.1.1

References

www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1900