Security Flaw in Jenkins Job Configuration History Plugin by Jenkins

CVE-2023-41933

What is CVE-2023-41933?

The Jenkins Job Configuration History Plugin version 1227.v7a_79fc4dc01f and earlier lacks proper configuration for its XML parser, making it prone to XML External Entity (XXE) attacks. This vulnerability allows attackers to exploit the XML parser to read sensitive files from the server or perform internal network requests. Ensuring that XML external entities are disabled in the parser configuration can mitigate the risks associated with this vulnerability.

References