Paper/Archive/CVE-2021-21669

CVE-2021-21669

Jenkins project Jenkins Generic Webhook Trigger Plugin — Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

EPSS 26%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.0.980 × 2019.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected

ProductAffectedFixed inSource

Jenkins Generic Webhook Trigger Pluginunspecified – 1.72–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refjenkins.io/security/advisory/2021-06-18/#SECURITY-2330 refopenwall.com/lists/oss-security/2021/06/18/1