CVE-2020-2120: 
Java vulnerability analysis and mitigation

CVE-2020-2120 is an XML External Entity (XXE) vulnerability discovered in the FitNesse Plugin for Jenkins, affecting versions 1.30 and earlier. The vulnerability was disclosed on February 12, 2020, and impacts the plugin's XML parser configuration (Jenkins Advisory).

The vulnerability stems from the FitNesse Plugin's failure to configure its XML parser to prevent XML external entity (XXE) attacks. The severity is rated as High according to the CVSS scoring system. The vulnerability exists in the post-build step functionality of the plugin (Jenkins Advisory).

This vulnerability allows users with control over input files for the plugin's post-build step to have Jenkins parse crafted files that use external entities. This can lead to extraction of secrets from the Jenkins controller, enable server-side request forgery, or facilitate denial-of-service attacks (Jenkins Advisory, OSS Security).

The vulnerability has been fixed in FitNesse Plugin version 1.31, which disables external entity processing for its XML parser. Users are strongly advised to upgrade to this version or later to mitigate the vulnerability (Jenkins Advisory).