Description
Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Remediation
References
https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2940
Related Vulnerabilities
CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-web-api
CVE-2019-1003081 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2023-37478 Vulnerability in npm package @pnpm/cafs
CVE-2022-36920 Vulnerability in maven package org.jenkins-ci.plugins:coverity
CVE-2012-5885 Vulnerability in maven package org.apache.tomcat:catalina