Description
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Remediation
References
https://jenkins.io/security/advisory/2018-01-22/
Related Vulnerabilities
CVE-2021-3859 Vulnerability in maven package io.undertow:undertow-core
CVE-2022-45935 Vulnerability in maven package org.apache.james:james-server-data-file
CVE-2017-15684 Vulnerability in maven package org.craftercms:crafter-studio
CVE-2023-40336 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-folder
CVE-2014-6439 Vulnerability in maven package org.elasticsearch:elasticsearch