-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parsing in the loadSeries method. The pre-patch code (shown in the diff) used xpath.evaluate(xpathString, inputSource, nodeType) with a raw InputSource created from user-controlled files. This configuration didn't disable XXE protections. The fix replaced this with XMLUtils.parse(in) which applies Jenkins' secure XML parser configuration. The added SAXException handling and test4.xml validation confirm the XXE protection was missing in this function prior to 2.1.12.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:plot | maven | < 2.1.12 | 2.1.12 |
JavaJavaOngoing coverage of React2Shell