CVE-2020-2304

Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

• https://www.openwall.com/lists/oss-security/2020/11/04/6Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145Vendor Advisory
• https://www.openwall.com/lists/oss-security/2020/11/04/6Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2145Vendor Advisory

Published

Nov 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-23026A NULL pointer dereference in the main() function dhry_1.c o…7.5
• CVE-2020-2303A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2020-23036MEDIA NAVI Inc SMACom v1.2 was discovered to contain an inse…5.9
• CVE-2020-23037Portable Ltd Playable v9.18 contains a code injection vulner…9.8
• CVE-2020-23038Swift File Transfer Mobile v1.1.2 and below was discovered t…7.5
• CVE-2020-23039Folder Lock v3.4.5 was discovered to contain a stored cross-…5.4
• CVE-2020-23040Sky File v2.1.0 contains a directory traversal vulnerability…7.5
• CVE-2020-23041Dropouts Technologies LLP Air Share v1.2 was discovered to c…6.1
• CVE-2020-23042Dropouts Technologies LLP Super Backup v2.0.5 was discovered…6.1
• CVE-2020-23043Tran Tu Air Sender v1.0.2 was discovered to contain an arbit…8.8
• CVE-2020-23044DedeCMS v7.5 SP2 was discovered to contain multiple cross-si…5.4
• CVE-2020-23045Macrob7 Macs Framework Content Management System - 1.14f was…7.2