high7.1
CVE-2023-28684
Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks
Impact
Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.sap.jenkinsci:remote-jobs-view-plugin | <= 0.0.3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Remote-Jobs-View | through 0.0.3 |