XML External Entity Vulnerability in Jenkins Config File Provider Plugin
CVE-2021-21642

8.1HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Config File Provider Plugin
Vendor
CVE Published:
21 April 2021

Summary

The Jenkins Config File Provider Plugin versions 3.7.0 and prior are vulnerable due to misconfiguration of its XML parser, making them susceptible to XML External Entity (XXE) attacks. This flaw can potentially allow attackers to interfere with the application’s processing of XML data, leading to exposure of sensitive information or other types of manipulation. Users are urged to update to a patched version and take necessary protective measures.

Affected Version(s)

Jenkins Config File Provider Plugin <= 3.7.0

References

https://www.jenkins.io/security/advisory/2021-04-21/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/04/21/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.