Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows a user able to control the input files for the 'Publish Cobertura Coverage Report' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Cobertura Plugin 1.16 disables external entity resolution for its XML parser.
{ "nvd_published_at": "2020-03-09T16:15:00Z", "cwe_ids": [ "CWE-611" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-01-05T20:21:53Z" }