CVE-2023-49656

The XML parser built into the plugin is not configured to block references to external XML entities (XML External Entities). An attacker can provide a specially crafted XML document containing references to external resources or local system files. The Jenkins server processes such a document and as a result discloses file contents or performs other operations in the context of the server.

An attacker without any authentication can read arbitrary files available to the Jenkins process (e.g., SSH keys, configuration data, CI/CD secrets) and potentially conduct SSRF attacks on internal resources, which may lead to complete compromise of the CI/CD environment.

Update Jenkins MATLAB Plugin to a version newer than 2.11.0, which includes proper XML parser configuration blocking XXE attacks. Details are available in the official Jenkins security bulletin at https://www.jenkins.io/security/advisory/2023-11-29/#SECURITY-3193

Jenkins MATLAB Plugin version 2.11.0 and earlier