Description
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Remediation
References
https://jenkins.io/security/advisory/2018-01-22/
Related Vulnerabilities
CVE-2023-28155 Vulnerability in maven package org.webjars.npm:request
CVE-2023-25813 Vulnerability in npm package sequelize
CVE-2016-10366 Vulnerability in npm package kibana
CVE-2023-34189 Vulnerability in maven package org.apache.inlong:manager-web
CVE-2023-25158 Vulnerability in maven package org.geotools.jdbc:gt-jdbc-oracle