CVE-2023-28680 - Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

HIGH

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

Published Mar 23, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.77%

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0	affected	<=0.9

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1397		Advisory
https://github.com/advisories/GHSA-vq5h-qgxm-2m39		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-28680
https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2925		vendor-advisoryVendor Advisory