Skip to content
OpenAdvisories
High · 7.5 CVE-2023-28680 EUVD-2023-1397GHSA-vq5h-qgxm-2m39

Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks

Published Mar 23, 2023 · Updated Feb 25, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Crap4J Plugin Package: org.jenkins-ci.plugins:crap4j Category: Web / CMS Ecosystem: Maven

Description

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Crap4J Plugin ≤ 0.9 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:crap4j <= 0.9 — GHSA-vq5h-qgxm-2m39

Advisories 1

References