Description
Jenkins RQM Plugin 2.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Remediation
References
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2805
Related Vulnerabilities
CVE-2023-25813 Vulnerability in npm package sequelize
CVE-2020-24554 Vulnerability in maven package com.liferay.release.portal.bom
CVE-2023-45669 Vulnerability in maven package com.webauthn4j:webauthn4j-spring-security-core
CVE-2023-45648 Vulnerability in maven package org.apache.tomcat:tomcat-coyote
CVE-2019-1003071 Vulnerability in maven package hudson.plugins.octopusdeploy:octopusdeploy