CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NCVE-2023-28681
High (8.2) in jenkins visual studio code metrics. EPSS 0.6% chance of exploitation in the next 30 days.
Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:visual_studio_code_metrics
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8j88-2hfc-5rf3 | Maven | org.jenkins-ci.plugins:vs-code-metrics | <=1.7 | no fix published |