CVE-2020-2115: XXE vulnerability in NUnit Plugin
Summary
CVE-2020-2115: XXE vulnerability in NUnit Plugin. Affects org.jenkins-ci.plugins:nunit versions < 0.26. Fixed in 0.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The NUnit Plugin is a Maven package (org.jenkins-ci.plugins:nunit) used in Jenkins, an open-source automation server. It provides support for running NUnit tests as part of the Jenkins build process. The plugin allows users to configure post-build steps that involve parsing XML files. However, versions 0.25 and earlier of the NUnit Plugin do not properly configure the XML parser to prevent XML external entity (XXE) attacks.
Vulnerability Detail
The XXE vulnerability in the NUnit Plugin allows an attacker who can control the input files for the post-build step to exploit the XML parser. By crafting a malicious XML file, the attacker can perform various attacks, including extracting secrets from the Jenkins controller, initiating server-side request forgery, or launching denial-of-service attacks. This vulnerability poses a high risk to the security and integrity of the Jenkins environment. The issue has been assigned a CVSS score of 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).
How To Fix
Minimum fixed version
0.26
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the NUnit Plugin to ensure the security of the Jenkins environment.
Conclusion
The XXE vulnerability in NUnit Plugin (CVE-2020-2115) poses a significant risk to the security of Jenkins environments. It is crucial to update to the fixed version (0.26) of the NUnit Plugin to mitigate the vulnerability. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:nunit →
FAQ
The vulnerability allows an attacker to exploit the XML parser in the NUnit Plugin, potentially leading to unauthorized access to secrets, server-side request forgery, or denial-of-service attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the vulnerability has been fixed in NUnit Plugin version 0.26. It is recommended to update to the latest version to mitigate the risk.
No, there are no known workarounds for this vulnerability. Updating to the fixed version is the only solution.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-xvhf-q744-5xm8 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xvhf-q744-5xm8/GHSA-xvhf-q744-5xm8.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:nunit.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.