Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability

HOCH 7.1CVE-2023-28685 · GHSA-wf8m-qr47-xc9m · Published 22/03/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-28685 ist eine Schwachstelle (HOCH (CVSS 7.1)) in org.jenkins-ci.plugins:absint-a3, absint a3 (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.60%, höher als bei 48.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:absint-a3 Maven	`≤ 1.1.0`	No fix yet
absint a3 jenkins	`≤ 1.1.0`	No fix yet

Description

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control Project File (APX) contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

NVD description

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

References

nvd.nist.gov/vuln/detail/CVE-2023-28685 · ADVISORY
jenkins.io/security/advisory/2023-03-21 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free