CVE-2020-2178
XXE vulnerability in Jenkins Parasoft Findings Plugin
Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2178- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2178- Updated
- 2026-11-02
EUVDEUVD-2022-2042 No score
Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
EUVD-2022-2042- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2rh4-xgmq-63jp
XXE vulnerability in Jenkins Parasoft Findings Plugin
Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with Warnings Plugin (10.4.1 and earlier) and Warnings NG Plugin (10.4.2 and newer).
Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Parasoft Findings Plugin 10.4.4 disables external entity resolution for its XML parser.
- Record
GHSA-2rh4-xgmq-63jp- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2178- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-2rh4-xgmq-63jp
XXE vulnerability in Jenkins Parasoft Findings Plugin
Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with Warnings Plugin (10.4.1 and earlier) and Warnings NG Plugin (10.4.2 and newer).
Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Parasoft Findings Plugin 10.4.4 disables external entity resolution for its XML parser.
- Record
GHSA-2rh4-xgmq-63jp- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.parasoft:parasoft-findingsMaven |
through 10.4.3 | 10.4.4 |
com.parasoft:parasoft-findingsMaven |
before 10.4.4, plus listed versions 10.2.210.2.310.2.3.110.3.010.3.2 Show 8 moreShow less10.3.310.3.410.3.510.3.610.4.010.4.110.4.210.4.3 |
10.4.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2178 is a high vulnerability (CVSS 7.1) in Jenkins Parasoft Findings, published April 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in com.parasoft:parasoft-findings 10.4.4.