CVE-2023-28684: 
Java vulnerability analysis and mitigation

Jenkins remote-jobs-view-plugin Plugin version 0.0.3 and earlier contains an XML External Entity (XXE) vulnerability identified as CVE-2023-28684. The vulnerability was disclosed on March 21, 2023, and affects the plugin's XML parsing functionality. This security issue impacts authenticated users with Overall/Read permission (Jenkins Advisory).

The vulnerability stems from the plugin's failure to properly configure its XML parser to prevent XML external entity (XXE) attacks. The issue has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with Overall/Read permission to have Jenkins parse crafted XML documents that use external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory).

As of the advisory's publication date, no official fix is available for this vulnerability. The plugin remains vulnerable in version 0.0.3 and earlier versions (Jenkins Advisory).

The vulnerability was discovered and reported by security researchers LaNyer640 & Crilwa (Jenkins Advisory).