CVE-2020-2171: XXE vulnerability in Jenkins RapidDeploy Plugin
Summary
CVE-2020-2171: XXE vulnerability in Jenkins RapidDeploy Plugin. Affects org.jenkins-ci.plugins:rapiddeploy-jenkins versions < 4.2.1. Fixed in 4.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins RapidDeploy Plugin is a Maven-based plugin that allows for the deployment of applications using RapidDeploy. It integrates with Jenkins, a popular open-source automation server, to provide seamless deployment capabilities. The plugin enables users to build and deploy RapidDeploy deployment packages directly from Jenkins. It is widely used in software development and deployment workflows.
Vulnerability Detail
The RapidDeploy Plugin version 4.2 and earlier is vulnerable to an XML External Entity (XXE) attack. This vulnerability arises from the plugin's failure to configure its XML parser to prevent XXE attacks. As a result, an attacker who can control the input files for the 'RapidDeploy deployment package build' build or post-build step can exploit this vulnerability. By crafting a malicious file with external entities, the attacker can extract sensitive information from the Jenkins controller, perform server-side request forgery, or launch denial-of-service attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.6.
How To Fix
Latest published version: 4.9 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of the RapidDeploy Plugin.
Conclusion
The XXE vulnerability in the Jenkins RapidDeploy Plugin can have severe consequences, including unauthorized access, data breaches, and service disruption. It is crucial to upgrade to the latest version of the RapidDeploy Plugin (4.2.1 or later) to mitigate this vulnerability. Users should also regularly monitor for security advisories and apply necessary updates to ensure the security of their Jenkins installations. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:rapiddeploy-jenkins →
FAQ
An XML External Entity (XXE) vulnerability is a type of attack that exploits the ability of XML parsers to process external entities. By including malicious external entities in XML input, an attacker can manipulate the parser to disclose sensitive information, perform server-side request forgery, or cause denial-of-service.
This vulnerability allows an attacker to extract sensitive information from the Jenkins controller, perform server-side request forgery, or launch denial-of-service attacks. These actions can lead to unauthorized access, data breaches, and disruption of services.
You can use the Vulert Playground at Vulert Scanner to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix to mitigate the risk of exploitation.
For more information about this vulnerability, you can refer to the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g7w4-r4mg-gvhx/GHSA-g7w4-r4mg-gvhx.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:rapiddeploy-jenkins.
