CVE-2020-2144: XEE
Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Other sources
Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Rundeck Plugin 3.6.7 disables external entity resolution for its XML parser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:rundeckto a version that resolves this vulnerability.Fixed in 3.6.7 - Upgrade
Upgrade
Jenkins Rundeck Pluginto a version that resolves this vulnerability.Fixed in 3.6.7 - Compensating control
If upgrading is not immediately possible, restrict access to Jenkins Overall/Read so untrusted users cannot submit crafted HTTP requests with XML payloads for XXE-based secret extraction or SSRF.
Event History
Frequently Asked Questions
What is CVE-2020-2144?
CVE-2020-2144 is a vulnerability found in Jenkins Rundeck Plugin 3.6.6 and earlier that allows XML external entity (XXE) attacks.
How severe is CVE-2020-2144?
CVE-2020-2144 has a severity rating of 7.1, which is considered high.
How does CVE-2020-2144 affect Jenkins Rundeck Plugin?
CVE-2020-2144 affects Jenkins Rundeck Plugin 3.6.6 and earlier versions by not configuring its XML parser to prevent XXE attacks.
How can I fix CVE-2020-2144?
To fix CVE-2020-2144, update Jenkins Rundeck Plugin to version 3.6.7 or later.
Where can I find more information about CVE-2020-2144?
You can find more information about CVE-2020-2144 in the following references: [Openwall](http://www.openwall.com/lists/oss-security/2020/03/09/1) and [Jenkins Security Advisory](https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1702).