XML External Entity (XXE)

jenkins-2-plugins is vulnerable to XML external entity (XXE) attacks. The vulnerability exists because of a flaw was found in the subversion Jenkins plugin that was not configured properly to prevent XML external entity (XXE) attacks allowing an attacker the ability to control an agent process and have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.