Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-62bs-bqfj-bubj
Vulnerability ID VCID-62bs-bqfj-bubj
Aliases CVE-2020-2305
GHSA-x58r-wxc3-7pqr
Summary XXE vulnerability in Jenkins Mercurial Plugin Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks. This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-611 Improper Restriction of XML External Entity Reference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2305.json
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
epss 0.00503 https://api.first.org/data/v1/epss?cve=CVE-2020-2305
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-x58r-wxc3-7pqr
cvssv3.1 6.5 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2305.json
generic_textual MODERATE https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2305.json
cvssv3.1 6.5 https://github.com/jenkinsci/mercurial-plugin
generic_textual MODERATE https://github.com/jenkinsci/mercurial-plugin
cvssv3.1 6.5 https://github.com/jenkinsci/mercurial-plugin/commit/84af58b08f80bb92792f7bc04a31487f3eeee95a
generic_textual MODERATE https://github.com/jenkinsci/mercurial-plugin/commit/84af58b08f80bb92792f7bc04a31487f3eeee95a
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2020-2305
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-2305
cvssv3.1 6.5 https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
generic_textual MODERATE https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2305.json
https://api.first.org/data/v1/epss?cve=CVE-2020-2305
https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2305.json
https://github.com/jenkinsci/mercurial-plugin
https://github.com/jenkinsci/mercurial-plugin/commit/84af58b08f80bb92792f7bc04a31487f3eeee95a
https://nvd.nist.gov/vuln/detail/CVE-2020-2305
https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
1895940 https://bugzilla.redhat.com/show_bug.cgi?id=1895940
GHSA-x58r-wxc3-7pqr https://github.com/advisories/GHSA-x58r-wxc3-7pqr
RHSA-2021:0034 https://access.redhat.com/errata/RHSA-2021:0034
RHSA-2021:0038 https://access.redhat.com/errata/RHSA-2021:0038
RHSA-2021:0282 https://access.redhat.com/errata/RHSA-2021:0282
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2305.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2305.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/mercurial-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/jenkinsci/mercurial-plugin/commit/84af58b08f80bb92792f7bc04a31487f3eeee95a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-2305
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2115
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.66037
EPSS Score 0.00503
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:10:37.317110+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x58r-wxc3-7pqr/GHSA-x58r-wxc3-7pqr.json 38.0.0