{"id":"CVE-2020-2305","aliases":["EUVD-2022-5714","GHSA-x58r-wxc3-7pqr","RHSA-2021:0034","RHSA-2021:0038","RHSA-2021:0282","RHSA-2021:0637"],"status":"published","title":"XXE vulnerability in Jenkins Mercurial Plugin","description":"Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01494,"percentile":0.74343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2020-11-04T14:35:39Z","modified":"2026-10-24T10:30:43Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","fixed_in":["2.12","2.10.1","2.9.1","2.8.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11"},{"last_affected":"2.11"},{"fixed":"2.12"}]}],"versions":["2.11"]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10"},{"last_affected":"2.10"},{"fixed":"2.10.1"}]}],"versions":["2.10"]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9"},{"last_affected":"2.9"},{"fixed":"2.9.1"}]}],"versions":["2.9"]},{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11"},{"fixed":"2.12"}]}],"versions":["2.11"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10"},{"fixed":"2.10.1"}]}],"versions":["2.10"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9"},{"fixed":"2.9.1"}]}],"versions":["2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}],"versions":["1.37","1.38","1.39","1.40","1.41","1.42","1.43","1.44","1.45","1.46","1.47","1.48","1.48-beta-1","1.49","1.50","1.50-beta-1","1.50-beta-2","1.50.1","1.51","1.51-beta-1","1.51-beta-2","1.51-beta-3","1.52","1.53","1.54","1.55","1.56","1.57","1.58","1.58-beta-1","1.59","1.60","1.61","2.0","2.0-alpha-1","2.0-alpha-4","2.0-beta-1","2.1","2.2","2.3","2.4","2.5","2.6","2.7","2.8"]},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.1610108899-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"python2-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1608634578-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.1609853716-1.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012172338.p0.git.3800.30af700.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012172338.p0.git.3800.30af700.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.1-2.rhaos4.6.git2af9ecf.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.1-2.rhaos4.6.git2af9ecf.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.1-2.rhaos4.6.git2af9ecf.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012172338.p0.git.3800.30af700.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012172338.p0.git.3800.30af700.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.1611203637-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.263.3.1612433584-1.el7"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1612862361-1.el7"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-3.el7"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python2-rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-3.el7"}]}],"bundled":19}],"products":[{"vendor":"jenkins","product":"mercurial"},{"vendor":"jenkins project","product":"jenkins mercurial plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2305","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2305.json","tags":["web"]},{"url":"https://github.com/jenkinsci/mercurial-plugin/commit/84af58b08f80bb92792f7bc04a31487f3eeee95a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x58r-wxc3-7pqr"},{"url":"https://github.com/jenkinsci/mercurial-plugin","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0034","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913121","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0034.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2304","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2305","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2306","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2307","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2307","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-1646","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2308","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2102","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2309","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-2309","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2309","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-26137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26137","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0038","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1897635","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0038.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28362","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0282","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921164","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0282.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0637","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1837444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1849003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1873346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1889972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1903702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929216","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0637.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1945","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11979","tags":["advisory"]},{"url":"https://security.gentoo.org/glsa/202011-18","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25658","tags":["advisory"]},{"url":"https://github.com/sybrenstuvel/python-rsa/issues/165","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21602","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21602","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21603","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21603","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925157","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21604","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21606","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21607","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21607","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925140","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21609","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21610","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21611","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-2305","description":"Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","status":"published","published":"2020-11-04T14:35:39Z","modified":"2024-08-04T07:09:53.308Z","updated_at":"2026-11-02T14:35:51.206854Z"}],"euvd":[{"id":"EUVD-2022-5714","description":"Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","status":"published","published":"2020-11-04T14:35:39Z","modified":"2024-08-04T07:09:53Z","updated_at":"2026-11-03T03:08:09.929524Z"}],"ghsa":[{"id":"GHSA-x58r-wxc3-7pqr","title":"XXE vulnerability in Jenkins Mercurial Plugin","description":"Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nMercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.","status":"published","published":"2022-05-24T17:33:07Z","modified":"2023-12-14T19:23:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:26.012325Z"}],"nvd":[{"id":"CVE-2020-2305","description":"Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","status":"published","published":"2020-11-04T15:15:11.49Z","modified":"2026-06-17T03:12:10.833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-2305","description":"Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.","status":"published","published":"2020-11-04T15:15:11.49Z","modified":"2026-10-24T10:30:43.025216746Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"GHSA-x58r-wxc3-7pqr","title":"XXE vulnerability in Jenkins Mercurial Plugin","description":"Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks.\n\nThis allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nMercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.","status":"published","published":"2022-05-24T17:33:07Z","modified":"2024-02-16T08:19:33.376789Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"RHSA-2021:0034","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5.27 packages and security update","status":"published","published":"2024-09-18T04:29:33Z","modified":"2026-06-29T10:33:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0038","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.12 packages and security update","status":"published","published":"2024-09-16T05:17:59Z","modified":"2026-10-13T10:02:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0282","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.33 packages and security update","status":"published","published":"2024-09-16T05:18:15Z","modified":"2025-11-22T12:16:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0637","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11.394 bug fix and security update","status":"published","published":"2024-09-16T05:24:26Z","modified":"2026-08-12T10:01:29Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"}]}}