Description
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
Remediation
References
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698
Related Vulnerabilities
CVE-2023-29234 Vulnerability in maven package org.apache.dubbo:dubbo
CVE-2020-6428 Vulnerability in npm package electron
CVE-2021-30638 Vulnerability in maven package org.apache.tapestry:tapestry-core
CVE-2023-33939 Vulnerability in maven package com.liferay:com.liferay.portal.search.web
CVE-2021-3644 Vulnerability in maven package org.wildfly.core:wildfly-controller