PT-2021-14699 · Jenkins · Jenkins Xcode Integration Plugin+1

Kevin Guerroudj · Published 2021-05-11 · Updated 2023-10-25 · CVE-2021-21656

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Xcode integration Plugin versions 2.0.14 and earlier

Description The issue is related to the configuration of the XML parser, which does not prevent XML external entity (XXE) attacks.

Recommendations For Jenkins Xcode integration Plugin versions 2.0.14 and earlier, update to a version that properly configures its XML parser to prevent XXE attacks.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-21656

GHSA-WFXP-4QGW-QP3C

Affected Products

Jenkins

Jenkins Xcode Integration Plugin

References · 5

• https://jenkins.io/security/advisory/2021-05-11/#SECURITY-2335 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21656 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfxp-4qgw-qp3c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21656 · Security Note
• https://github.com/jenkinsci/xcode-plugin/commit/01335f1f4734e4a7eda69b28e182ecd4c34a1a4b · Note