Skip to content
Fencer Intel
medium 6.5

CVE-2020-2305 json

XXE vulnerability in Jenkins Mercurial Plugin

published 6y ago modified 4mo ago also GHSA-x58r-wxc3-7pqr , EUVD-2022-5714

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Patch / fix

  • maven org.jenkins-ci.plugins:mercurial 2.8.1, 2.9.1, 2.10.1, 2.12
  • Jenkins project Jenkins Mercurial Plugin 2.8.1, 2.9.1, 2.10.1
  • python-urllib3 openshift 4.5 1.26.2-1.el7
  • python2-urllib3 openshift 4.5 1.26.2-1.el7
  • jenkins-2-plugins openshift 4.5 4.5.1610108899-1.el7
  • jenkins openshift 3.11 2.263.3.1612433584-1.el7
  • python-rsa openshift 3.11 4.5-3.el7
  • python2-rsa openshift 3.11 4.5-3.el7
  • jenkins-2-plugins openshift 3.11 3.11.1612862361-1.el7
  • jenkins-2-plugins openshift 4.4 4.4.1611203637-1.el7

red hat advisories RHSA-2021:0034RHSA-2021:0637RHSA-2021:0282RHSA-2021:0038

Is CVE-2020-2305 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-2305 updated cvss 6.5

jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks

  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins 3.11.1612862361-1.el7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:0637
  • Red Hat OpenShift Container Platform 4.4 jenkins-2-plugins 4.4.1611203637-1.el7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:0282
  • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1610108899-1.el7
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:0034
  • Red Hat OpenShift Container Platform 4.6 jenkins-2-plugins 4.6.1608634578-1.el7, jenkins-2-plugins 4.6.1609853716-1.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.” RHSA-2021:0038
  • Red Hat OpenShift Container Platform 3.11 haproxy 1.8.28-1.el7, python-rsa 4.5-3.el7, python2-rsa 4.5-3.el7, haproxy18 1.8.28-1.el7, jenkins 2.263.3.1612433584-1.el7, prometheus 3.11.394-1.git.5026.2c9627f.el7, +39 more Red Hat OpenShift Container Platform 4.4 openshift 4.4.0-202101221150.p0.git.0.f7ab6b8.el7, openshift 4.4.0-202101221150.p0.git.0.f7ab6b8.el8, openshift-kuryr 4.4.0-202101082241.p0.git.1821.1a159eb.el8, openshift-hyperkube 4.4.0-202101221150.p0.git.0.f7ab6b8.el7, openshift-hyperkube 4.4.0-202101221150.p0.git.0.f7ab6b8.el8, openshift-kuryr-cni 4.4.0-202101082241.p0.git.1821.1a159eb.el8, +3 more Red Hat OpenShift Container Platform 4.5 python-urllib3 1.26.2-1.el7, python2-urllib3 1.26.2-1.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el7, cri-o 1.18.4-5.rhaos4.5.gitd655863.el8, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el7, openshift 4.5.0-202012221738.p0.git.0.9c544e4.el8, +8 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.1-2.rhaos4.6.git2af9ecf.el8, console-login-helper-messages 0.20.3-1.rhaos4.6.el8, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el7, openshift 4.6.0-202012190744.p0.git.94235.c62c6f7.el8, openshift-ansible 4.6.0-202012172338.p0.git.0.a15d08c.el7, openshift-kuryr 4.6.0-202012171504.p0.git.2216.1fecf92.el8, +14 more
    not affected: vulnerable code not present “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.plugins:mercurial
>=2.11, <2.12
>=2.10, <2.10.1
>=2.9, <2.9.1
<2.8.1
2.12
2.10.1
2.9.1
2.8.1

Affected products

  • Jenkins project Jenkins Mercurial Plugin

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.