XXE vulnerability in Jenkins Klocwork Analysis Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:klocwork
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2020-2245
CVE-2020-2246
CVE-2020-2247
CWE: CWE-611
CWE-79
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Klocwork plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.


Mitigations:

Architectural layers (MAESTRO):