CVE-2023-28683: 
Java vulnerability analysis and mitigation

Jenkins Phabricator Differential Plugin version 2.1.5 and earlier contains an XML External Entity (XXE) vulnerability (CVE-2023-28683) discovered in March 2023. The vulnerability affects the plugin's XML parsing functionality, specifically in the 'Post to Phabricator' post-build action (Jenkins Advisory).

The vulnerability stems from improper configuration of the XML parser, which fails to prevent XML External Entity (XXE) attacks. The issue has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers who can control coverage report file contents for the 'Post to Phabricator' post-build action to have Jenkins parse crafted XML documents that use external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory).

As of the advisory's publication date, no official fix is available for this vulnerability. The plugin is listed among those without available fixes in the Jenkins security advisory (Jenkins Advisory).

The vulnerability was discovered and reported by CC Bomber and Kitri BoB, as acknowledged in the Jenkins security advisory (Jenkins Advisory).