CVE-2020-2247
XXE vulnerability in Jenkins Klocwork Analysis Plugin
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2247- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2247- Updated
- 2026-11-02
EUVDEUVD-2022-4694 No score
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
EUVD-2022-4694- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6c5-737r-2r93
XXE vulnerability in Jenkins Klocwork Analysis Plugin
Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for the Klocwork plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
- Record
GHSA-p6c5-737r-2r93- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Record
CVE-2020-2247- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-p6c5-737r-2r93
XXE vulnerability in Jenkins Klocwork Analysis Plugin
Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for the Klocwork plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
- Record
GHSA-p6c5-737r-2r93- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:klocworkMaven |
through 2020.2.1 | 2020.3.1 |
org.jenkins-ci.plugins:klocworkMaven |
before 2020.3.1, plus listed versions 1.101.111.121.131.14 Show 41 moreShow less1.14.11.151.16.21.16.31.171.181.24.61.92.02.12.22.2.12.2.22.2.32.32.3.12.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.92.5.02.5.12.5.22.5.32020.22020.2.12020.3 |
2020.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2247 is a medium vulnerability (CVSS 6.5) in Jenkins Klocwork Analysis, published September 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in org.jenkins-ci.plugins:klocwork 2020.3.1.