CVE-2023-28682: 
Java vulnerability analysis and mitigation

Jenkins Performance Publisher Plugin version 8.09 and earlier contains an XML External Entity (XXE) vulnerability identified as CVE-2023-28682. The vulnerability was disclosed on March 21, 2023, as part of the Jenkins Security Advisory. This security issue affects the Performance Publisher Plugin's XML parsing functionality (Jenkins Advisory).

The vulnerability stems from the plugin's failure to properly configure its XML parser to prevent XML external entity (XXE) attacks. The issue has been assigned a CVSS v3.1 base score of 8.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers with the ability to control PerfPublisher report files to have Jenkins parse a crafted XML document that uses external entities. This can lead to the extraction of secrets from the Jenkins controller or enable server-side request forgery (SSRF) attacks (Jenkins Advisory).

As of the advisory publication date, no official fix has been released for this vulnerability. The Performance Publisher Plugin version 8.09 and all earlier versions are affected, and users are advised to monitor for updates (Jenkins Advisory).

The vulnerability was discovered and reported by CC Bomber from Kitri BoB, as acknowledged in the Jenkins security advisory (Jenkins Advisory).