CVE-2020-2315: XXE vulnerability in Jenkins Visualworks Store Plugin
Summary
CVE-2020-2315: XXE vulnerability in Jenkins Visualworks Store Plugin. Affects org.jenkins-ci.plugins:visualworks-store versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Visualworks Store Plugin is a Maven package (org.jenkins-ci.plugins:visualworks-store) that provides functionality for managing and storing Visualworks scripts in Jenkins. It allows users to run Visualworks with StoreCI and control agent processes. The plugin uses an XML parser to parse files.
Vulnerability Detail
The Visualworks Store Plugin version 1.1.3 and earlier does not properly configure its XML parser, making it vulnerable to XML external entity (XXE) attacks. This means that an attacker who can control the output of a script running Visualworks with StoreCI or control an agent process can exploit this vulnerability. By crafting a malicious file with external entities, the attacker can extract secrets from the Jenkins controller or perform server-side request forgery. The vulnerability has been assigned a CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
How To Fix
Latest published version: 1.1.4 as of 22 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the plugin.
Conclusion
The XXE vulnerability in Jenkins Visualworks Store Plugin (CVE-2020-2315) can be exploited by attackers to extract secrets or perform server-side request forgery. It is recommended to update to version 1.1.4 or later of the plugin to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:visualworks-store →
FAQ
This vulnerability allows an attacker to extract secrets from the Jenkins controller or perform server-side request forgery.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, only versions 1.1.3 and earlier are affected. Version 1.1.4 and later have fixed the vulnerability.
No, there is no known workaround. It is crucial to update to the fixed version of the plugin.
The CVSS score of this vulnerability is 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
