1. Home
  2. CVE Database
  3. CVE-2020-2092
HIGH · 8.8

CVE-2020-2092

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML doc...

Vulnerability Description

Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
JenkinsRobot Framework<= 2.0.0

Related Weaknesses (CWE)

CWE-611

References

FAQ

What is CVE-2020-2092?

CVE-2020-2092 is a vulnerability with a CVSS score of 8.8 (HIGH). Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML doc...

How severe is CVE-2020-2092?

CVE-2020-2092 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-2092?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Robot Framework.