CVE-2021-43576 - Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery

Back Back to CVE browser

MEDIUM

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery

Published Nov 12, 2021

6.5

MEDIUM

CVSS 3.1

EPSS 2.44%

Description

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Affected products

Vendor Jenkins project Product Jenkins pom2config Plugin Default
unknown
Affected
- ≥ unspecified, ≤ 1.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins pom2config Plugin	unknown	Affected ≥ unspecified, ≤ 1.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (6)

http://www.openwall.com/lists/oss-security/2021/11/12/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4804
Advisory
https://github.com/advisories/GHSA-ppv9-v43c-xqpp
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43576
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415
x_refsource_CONFIRMVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1314/
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2021/11/12/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4804		Advisory
https://github.com/advisories/GHSA-ppv9-v43c-xqpp		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-43576
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415		x_refsource_CONFIRMVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1314/		x_refsource_MISCThird Party AdvisoryVDB Entry