Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2415 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2021/11/12/1 | Mailing List Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-1314/ | Third Party Advisory VDB Entry |
Configurations
History
22 Nov 2023, 21:33
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-611 | |
| References | (MISC) https://www.zerodayinitiative.com/advisories/ZDI-21-1314/ - Third Party Advisory, VDB Entry |
25 Oct 2023, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
Information
Published : 2021-11-12 11:15
Updated : 2023-11-22 21:33
NVD link : CVE-2021-43576
Mitre link : CVE-2021-43576
JSON object : View
Products Affected
jenkins
- pom2config
CWE
CWE-611
Improper Restriction of XML External Entity Reference