CVE-2022-28154: 
Java vulnerability analysis and mitigation

CVE-2022-28154 affects the Jenkins Coverage/Complexity Scatter Plot Plugin versions 1.1.1 and earlier. This high-severity vulnerability was discovered and reported by Jeff Thompson of CloudBees, Inc. and was publicly disclosed on March 29, 2022 (Jenkins Advisory).

The vulnerability is an XML External Entity (XXE) attack vulnerability, identified as SECURITY-1899. The core issue stems from the plugin's failure to configure its XML parser to prevent XXE attacks. The vulnerability has been assigned a severity rating of High according to the CVSS scoring system (Jenkins Advisory).

This vulnerability allows attackers who can control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse crafted files that use external entities. This can lead to the extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory).

As of the advisory's publication date on March 29, 2022, no fixes were available for this vulnerability. Users of the Coverage/Complexity Scatter Plot Plugin should monitor for updates and consider implementing additional security controls to restrict access to the affected functionality (Jenkins Advisory).