Description
Jenkins Robot Framework Plugin 2.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure to have Jenkins parse crafted XML documents.
Remediation
References
https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1698
Related Vulnerabilities
CVE-2023-25194 Vulnerability in maven package org.apache.kafka:kafka-clients
CVE-2023-45827 Vulnerability in npm package @clickbar/dot-diver
CVE-2020-17518 Vulnerability in maven package org.apache.flink:flink-runtime_2.11
CVE-2018-6874 Vulnerability in npm package auth0-lock
CVE-2023-46243 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore