Skip to content
OpenAdvisories
High · 8.2 CVE-2023-28681 EUVD-2023-1238GHSA-8j88-2hfc-5rf3

Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks

Published Mar 23, 2023 · Updated Feb 25, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Visual Studio Code Metrics Plugin Package: org.jenkins-ci.plugins:vs-code-metrics Category: Web / CMS Ecosystem: Maven

Description

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Visual Studio Code Metrics Plugin ≤ 1.7 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:vs-code-metrics <= 1.7 — GHSA-8j88-2hfc-5rf3

Advisories 1

References