XML External Entity (XXE)

Jenkins Config File Provider Plugin is vulnerable to XML external entity (XXE). It does not configure its XML parser to prevent XML external entity (XXE) attacks. A flaw was found in the config-file-provider Jenkins plugin. The plugin XML parser wasn’t configure to prevent XML external entity (XXE) attacks. An attacker with the ability to define Maven configuration files can use this vulnerability to prepare a crafted configuration file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.