CVE-2023-28682 - Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

HIGH

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks

Published Mar 23, 2023

8.2

HIGH

CVSS 3.1

EPSS 0.57%

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
0	affected	<=8.09

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1376		Advisory
https://github.com/advisories/GHSA-qgm7-m77f-j8pf		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-28682
https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2928		vendor-advisoryVendor Advisory