CVE-2023-41933: 
Java vulnerability analysis and mitigation

CVE-2023-41933 is an XML External Entity (XXE) vulnerability discovered in Jenkins Job Configuration History Plugin versions 1227.v7a_79fc4dc01f and earlier. The vulnerability was disclosed on September 6, 2023, and affects the plugin's XML parser configuration (Jenkins Advisory, NVD).

The vulnerability stems from the plugin's failure to configure its XML parser to prevent XML external entity (XXE) attacks. The issue has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a serious security risk (NVD).

When exploited, this vulnerability allows attackers with Item/Configure permission to have Jenkins parse crafted XML documents that use external entities. This can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery attacks (Jenkins Advisory).

The vulnerability has been fixed in Job Configuration History Plugin version 1229.v3039470161a_d. The fix includes disabling external entity resolution for the XML parser. Users are strongly advised to upgrade to this version to protect against XXE attacks (Jenkins Advisory).