CVE-2020-2305: XXE vulnerability in Jenkins Mercurial Plugin
Summary
CVE-2020-2305: XXE vulnerability in Jenkins Mercurial Plugin. Affects org.jenkins-ci.plugins:mercurial across 4 version ranges.
< 2.8.1
>= 2.9, < 2.9.1
>= 2.10, < 2.10.1
>= 2.11, < 2.12
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mercurial Plugin is a Maven package that provides integration between Jenkins and the Mercurial version control system. It allows users to configure Jenkins jobs to interact with Mercurial repositories, enabling automated build and deployment processes. The plugin is widely used in software development and continuous integration workflows.
Vulnerability Detail
The Jenkins Mercurial Plugin versions 2.12, 2.10.1, 2.9.1, and 2.8.1 are vulnerable to an XML external entity (XXE) attack. The plugin's XML changelog parser is not properly configured to prevent XXE attacks. This vulnerability allows attackers who can control an agent process to exploit a crafted changelog file, which can lead to the extraction of sensitive information from the Jenkins controller or server-side request forgery. The affected versions of the plugin have disabled external entity resolution for their XML parser.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.8.12.8.1 -
>= 2.9, < 2.9.12.9.1 -
>= 2.10, < 2.10.12.10.1 -
>= 2.11, < 2.122.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Jenkins Mercurial Plugin to the fixed version to mitigate the risk of exploitation.
Conclusion
The Jenkins Mercurial Plugin versions 2.12, 2.10.1, 2.9.1, and 2.8.1 are vulnerable to an XXE attack. To mitigate this vulnerability, it is recommended to update the plugin to version 2.12 or later. This can be done through the Jenkins interface by following the standard update process. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mercurial →
FAQ
An XML external entity (XXE) vulnerability is a type of security flaw that allows an attacker to exploit XML parsers by including external entities in XML input. This can lead to various attacks, such as information disclosure or server-side request forgery.
An attacker who can control an agent process in Jenkins can craft a malicious changelog file that includes external entities. When the Jenkins Mercurial Plugin parses this file, it may disclose sensitive information or perform unintended actions on behalf of the attacker.
No, only versions prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 are affected. These versions have disabled external entity resolution for their XML parser to mitigate the vulnerability.
Yes, upgrading the Jenkins Mercurial Plugin to version 2.12 or later fixes this vulnerability. Users should update the plugin through the Jenkins interface following the standard update process.
No, there is no known workaround for this vulnerability. It is crucial to update the plugin to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mercurial.
