Description
Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Remediation
References
http://www.securityfocus.com/bid/102844
https://jenkins.io/security/advisory/2018-01-22/
Related Vulnerabilities
CVE-2018-12537 Vulnerability in maven package io.vertx:vertx-core
CVE-2016-10661 Vulnerability in npm package phantomjs-cheniu
CVE-2022-0235 Vulnerability in npm package node-fetch
CVE-2021-44906 Vulnerability in npm package minimist
CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-api