high7.1
CVE-2023-28685
Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability
Impact
Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers able to control `Project File (APX)` contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:absint-a3 | <= 1.1.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Absint A3 | through 1.1.0 |