Skip to content
OpenAdvisories
High · 8.2 CVE-2023-28682 EUVD-2023-1376GHSA-qgm7-m77f-j8pf

Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks

Published Mar 23, 2023 · Updated Feb 25, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Performance Publisher Plugin Package: org.jenkins-ci.plugins:perfpublisher Category: Web / CMS Ecosystem: Maven

Description

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Performance Publisher Plugin ≤ 8.09 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:perfpublisher <= 8.09 — GHSA-qgm7-m77f-j8pf

Advisories 1

References