Description
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Remediation
References
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2973%20%282%29
Related Vulnerabilities
CVE-2020-2220 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2022-25167 Vulnerability in maven package org.apache.flume.flume-ng-sources:flume-jms-source
CVE-2009-1190 Vulnerability in maven package org.springframework:spring-core
CVE-2013-6468 Vulnerability in maven package org.drools:drools-workbench-models-test-scenarios
CVE-2021-21028 Vulnerability in maven package com.adobe.acs:acs-aem-commons