Token Macro Plugin did not configure its XML parser in a way that would prevent XML External Entity (XXE) processing. This allowed attackers able to control the contents of files processed with the ${XML} macro to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Token Macro Plugin no longer processes XML External Entities in XML documents.
References:
https://jenkins.io/security/advisory/2019-06-11/
Token Macro Plugin did not configure its XML parser in a way that would prevent XML External Entity (XXE) processing. This allowed attackers able to control the contents of files processed with the ${XML} macro to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Token Macro Plugin no longer processes XML External Entities in XML documents. References: https://jenkins.io/security/advisory/2019-06-11/