XML External Entity Vulnerability in Jenkins OWASP Dependency-Check Plugin
CVE-2021-43577

7.1HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Owasp Dependency-check Plugin
Vendor
CVE Published:
12 November 2021

Summary

The Jenkins OWASP Dependency-Check Plugin versions 5.1.1 and earlier are susceptible to XML External Entity (XXE) attacks. This vulnerability arises from the inadequate configuration of the XML parser, allowing attackers to exploit the parser's ability to process external entities. Such exploitation can lead to unauthorized access to sensitive data or the execution of malicious commands. Users are advised to upgrade to the latest version of the plugin to mitigate this security risk.

Affected Version(s)

Jenkins OWASP Dependency-Check Plugin <= 5.1.1

References

https://www.jenkins.io/security/advisory/2021-11-12/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2021/11/12/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.