CVE-2023-28681: 
Java vulnerability analysis and mitigation

Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier contains a security vulnerability identified as CVE-2023-28681. The vulnerability was discovered and disclosed on March 21, 2023, affecting all versions up to and including 1.7 of the Visual Studio Code Metrics Plugin for Jenkins (Jenkins Advisory).

The vulnerability is classified as an XML External Entity (XXE) attack vulnerability with a CVSS v3.1 base score of 8.2 (HIGH). The core issue stems from the plugin's failure to properly configure its XML parser to prevent XXE attacks. This misconfiguration in the XML parsing functionality creates a security weakness that could be exploited through crafted XML documents (NVD).

The vulnerability allows attackers who can control VS Code Metrics File contents to have Jenkins parse a crafted XML document that uses external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory).

As of the advisory publication date, no official fix was available for this vulnerability. The Jenkins security team has acknowledged the issue but has not released a patched version (Jenkins Advisory).