XML External Entity Configuration Issue in Jenkins Generic Webhook Trigger Plugin
CVE-2021-21669

9.8CRITICAL

Key Information:

Vendor
Jenkins
Status
Jenkins Generic Webhook Trigger Plugin
Vendor
CVE Published:
18 June 2021

Summary

The Jenkins Generic Webhook Trigger Plugin prior to version 1.73 is susceptible to an XML external entity (XXE) vulnerability. This issue arises because the plugin fails to properly configure its XML parser, making it vulnerable to exploitation through maliciously crafted XML input. An attacker could leverage this flaw to disrupt service or access sensitive data stored on the server. It is crucial for users to update to the latest version of the plugin to mitigate this risk.

Affected Version(s)

Jenkins Generic Webhook Trigger Plugin <= 1.72

References

https://www.jenkins.io/security/advisory/2021-06-18/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/06/18/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.