CVE-2021-43576

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read…

published November 12, 2021

CVSS
—
EPSS
2%
Percentile
84.2
In the wild
Unconfirmed
What it is

Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02444 · 84.2th percentile
Published
2021-11-12T10:35Z
EPSS history
Timeline
  • 12 NOV 10:35Z
    Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers with Overall/Read…
    cvelistv5