CVE-2020-2171: 
Java vulnerability analysis and mitigation

CVE-2020-2171 is a high severity vulnerability affecting the Jenkins RapidDeploy Plugin versions 4.2 and earlier. The vulnerability was discovered and reported by Daniel Beck from CloudBees, Inc. and was publicly disclosed on March 25, 2020. The issue affects the XML parser configuration in the RapidDeploy Plugin, which failed to prevent XML external entity (XXE) attacks (Jenkins Advisory).

The vulnerability stems from the RapidDeploy Plugin's failure to configure its XML parser to prevent XML external entity (XXE) attacks. The issue received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is specifically related to the 'RapidDeploy deployment package build' build or post-build step functionality (NVD).

The vulnerability allows attackers who can control input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse crafted files that use external entities. This can lead to extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks (Jenkins Advisory).

The vulnerability was fixed in RapidDeploy Plugin version 4.2.1, which disables external entity resolution for its XML parser. Users are strongly advised to upgrade to this version or later to address the security issue (Jenkins Advisory).