CVE-2018-1000054: Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference

The vulnerability stems from insecure XML parsing in the CCM Plugin. The advisory explicitly states the plugin processes XML files with external entity resolution enabled. While no exact code is provided, XXE vulnerabilities in Java typically occur in XML parsing functions using DocumentBuilder/SAXParser without disabling DTDs (via features like XMLConstants.FEATURE_SECURE_PROCESSING). The CcmParser class is the logical location for XML processing in a CCM report analysis plugin, and the patched version (3.2) likely added secure parser configuration here. This matches the CWE-611 pattern and Jenkins' own mitigation description ('external entity resolution has been disabled').